About the “Security Issue” on VLC
twitter.com
About the “Security Issue” on VLC
1–10 of 174 posts
Re: About the “Security Issue” on VLC
#2So none of the tech news websites contacted VideoLAN and published their articles without checking their source.
I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second.
I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
Re: About the “Security Issue” on VLC
#3So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474
To boot https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it
Re: About the “Security Issue” on VLC
#4[deleted]
Re: About the “Security Issue” on VLC
#5Compiled here: https://threader.app/thread/1153963312981389312
Re: About the “Security Issue” on VLC
#6[deleted]
Re: About the “Security Issue” on VLC
#7So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
News articles not checking sources is pretty standard. A few years ago I had a blog post about something regarding Apple picked up by the Hong Kong Free Press and then the New York Times. It ended up resulting in articles across hundreds of publications. The only publications that talked to me and Apple were the New York Times, the original Hong Kong Free Press and a CNN money reporter. Everyone else was just rewriting other posts.
The economics of the industry drive this behavior - most reporters have a quota of stories they have to write per day and there's no time or budget to even email sources let alone sit around waiting for a reply.
If you want to read more about this, I recommend the book "Trust me, I'm lying" by Ryan Holiday.
Re: About the “Security Issue” on VLC
#8MITREs response to this is a perfect example of the old-school security team mindset.
If I had a nickel for every security team I've worked with that a) treat reporting as gospel and don't validate it, and b) don't talk to the developer.
From my experience the key issue is they don't understand the issue enough to engage in a meaningful discussion with the developer
Re: About the “Security Issue” on VLC
#9So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
I expect a little bit of personal responsibility at this point. You simply should not believe what you read in the news. It's either not researched at all or just false.
Re: About the “Security Issue” on VLC
#10So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
> So none of the tech news websites contacted VideoLAN and published their articles without checking their source.
Actually, one did: numerama. That's all.
> I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
My night and morning have been difficult, as you can imagine...