Critical Security Release for GitLab 8.2 through 8.7
about.gitlab.com
Critical Security Release for GitLab 8.2 through 8.7
1–10 of 37 posts
Re: Critical Security Release for GitLab 8.2 through 8.7
#2Is it just me or has gitlab issued a lot of critical security releases lately?
I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Re: Critical Security Release for GitLab 8.2 through 8.7
#3Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Having worked in a large set of codebases as a consultant, I'm pretty sure it's the former. The code that runs the world is mostly garbage (the proprietary stuff that is, because they can hide it)
Re: Critical Security Release for GitLab 8.2 through 8.7
#4Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Other commentor already nailed it I think. How many critical security issues do you think Github has had that you've never heard of? Not knocking Github, it's just the nature of extreme open source I think.
Re: Critical Security Release for GitLab 8.2 through 8.7
#5Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Finding, fixing, and openly discussing software issues makes me more confident in GitLab, not less. I see this as a positive thing.
Re: Critical Security Release for GitLab 8.2 through 8.7
#6Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Your comment is weirdly similar to this other comment that I saw in the initial announcement:
Re: Critical Security Release for GitLab 8.2 through 8.7
#7Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
You should also factor in their software model. GitLab has a free install anyone can run locally without having to register. A competitor like GitHub has enterprise install but otherwise most public traffic is on their own hosted install. If there's a security issue they likely fix their hosted install and inform their enterprise customers only -- as well they probably shouldn't make it public otherwise it could be considered some level of exposure to their customers. Conversely GitLab essentially needs to publicize this to maintain the trust of their customers.
Re: Critical Security Release for GitLab 8.2 through 8.7
#8Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
Having worked in a large set of codebases as a consultant, I'm pretty sure it's the former. The code that runs the world is mostly garbage (the proprietary stuff that is, because they can hide it)
Similarly, never count on a compromise of your data to get reported unless local law absolutely requires it, and someone who cares notices. If your data was compromised in a way not covered by local law, companies will hide the compromise.
Re: Critical Security Release for GitLab 8.2 through 8.7
#9Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
There are other reasons too. Once someone finds an issue in an open-source project, other people realise it's not super secure and start to dig deeper. Same thing happened with image decoders (libpng), asn1 parsers, syscalls fuzzing, digging into openssl, etc. Bugs in big products and common protocols come in waves.
Re: Critical Security Release for GitLab 8.2 through 8.7
#10Is it just me or has gitlab issued a lot of critical security releases lately? I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.
I think that makes them more trustworthy. If some open source software has never seen a CVE, then that is because no-one actually looked at it in depth enough. All software has bugs and security issues.