Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the “Security Issue” on VLC

twitter.com

Post reply on HN
Print view View original

141–150 of 174 posts

Re: About the “Security Issue” on VLC

#141

Post by Mathnerd314 »

pgeorgi wrote: post #27
codewithcheese wrote: post #18

> The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. It's not a "old" version of Ubuntu its the latest LTS.

Just that Ubuntu apparently forgot about the "S" part of "LTS", or they could have updated that package. Alternatively (because libebml is "universe", that is, unsupported), stop ripping out maintained components from projects to "use system packages instead" which are not maintained. It's stuff like this that makes Firefox and Pale Moon play hardball with distros that mess up their software. (nevermind that the Pale…

The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster (https://askubuntu.com/questions/445487/what-debian-version-a...) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it updated in LTS releases.

tl;dr Avoid Ubuntu LTS because they don't maintain their packages properly.

Re: About the “Security Issue” on VLC

#142

Post by simonebrunozzi »

jbk wrote: post #10
LeonM wrote: post #2

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.

> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...

It will sound boring quickly, but I also want to thank you for developing VLC. Great work. Amazing work. You have many devoted fans all around the world.

Re: About the “Security Issue” on VLC

#143

Post by dvtrn »

Erwin wrote: post #123
Zenst wrote: post #30

Earlier quoted context omitted.

If VLC was a commercial product, this would be a lawyer time for effectively damaging reputation based upon lies and would see many media outlet dragged over the coals. VLC is not a commercial product, but equally still took the same impact from this and as we know, many end-user will be oblivious of any retraction as the case with many media retractions/corrections that get buried and do not traction. Maybe we need…

Remember the Bloomberg Supermicro story? If a billion-dollar company cannot get Bloomberg to retract their stories, what chance does an open source project have? Has any American newspaper or person or politician on twitter been forced to retract exaggerated claims?

Has any American newspaper or person or politician on twitter been forced to retract exaggerated claims?

Seemingly.

https://digitalcommons.wku.edu/cgi/viewcontent.cgi?article=1...

Re: About the “Security Issue” on VLC

#144

Post by xemdetia »

paddlepop wrote: post #8

MITREs response to this is a perfect example of the old-school security team mindset. If I had a nickel for every security team I've worked with that a) treat reporting as gospel and don't validate it, and b) don't talk to the developer. From my experience the key issue is they don't understand the issue enough to engage in a meaningful discussion with the developer

I think that this CVE issuance problem is getting worse recently where as in prior years there was just a smaller volume of CVE's being assigned. This VLC issue is the kind of CVE that could have been resolved by looking into it (or better assigned/described), and instead turned into a problem. There are also a string of people using security fuzzers to find issues but instead of them being triaged with security in mind they are getting CVE's issued. Some of the CVE's after investigation are test/utilities, pieces of code that are uncommon to be distributed, and a couple times code that is never called at all and was a function that never got cleaned up but when isolated had a stack overflow.

As someone who was recently a security engineer the treating as gospel is a real problem. In reviews of new CVE's you always ended up having to do the legwork to see if it was even relevant. Older CVE's I felt like usually were at least tied to something mostly concrete but the number of times I find the security report and it's just basically a valgrind/fuzzy lop output I am frustrated in the quality of reporting.

The other half of it is the journalists chasing clicks and researchers who name vulns to increase their status. That practice has really been a lot of crying wolf and it's starting to show. We had to create a special categories for vulnerabilities that were named/publicly visible and may or may not even be relevant to us just to respond to inquiries (especially things that were named but mediums on a NIST 90 day timeline but people expected resolved day 0-1).

Re: About the “Security Issue” on VLC

#145

Post by parliament32 »

Mathnerd314 wrote: post #141
pgeorgi wrote: post #27

Earlier quoted context omitted.

Just that Ubuntu apparently forgot about the "S" part of "LTS", or they could have updated that package. Alternatively (because libebml is "universe", that is, unsupported), stop ripping out maintained components from projects to "use system packages instead" which are not maintained. It's stuff like this that makes Firefox and Pale Moon play hardball with distros that mess up their software. (nevermind that the Pale…

The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster ( https://askubuntu.com/questions/445487/what-debian-version-a... ) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it u…

Stretch is supposed to keep getting security fixes until June 2022 but this particular library doesn't have the fix backported yet: https://security-tracker.debian.org/tracker/CVE-2019-13615

Re: About the “Security Issue” on VLC

#146

Post by chachachoney »

jbk wrote: post #10
LeonM wrote: post #2

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.

> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...

Off topic, but...

I've used VLC on all supported platforms for almost as long as it's been in existence: THANK YOU.

Re: About the “Security Issue” on VLC

#147

Post by chachachoney »

madez wrote: post #127
NikolaeVarius wrote: post #118

Earlier quoted context omitted.

Its amazing how a title can have two entirely contradictory, non committal claims telling you to do a thing, and yet tell me absolutely nothing useful.

Will you still read Gizmodo or consider it a trustable source?

The Gell-Man amnesia effect is quite strong.

Re: About the “Security Issue” on VLC

#148

Post by madez »

parliament32 wrote: post #145
Mathnerd314 wrote: post #141

Earlier quoted context omitted.

The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster ( https://askubuntu.com/questions/445487/what-debian-version-a... ) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it u…

Stretch is supposed to keep getting security fixes until June 2022 but this particular library doesn't have the fix backported yet: https://security-tracker.debian.org/tracker/CVE-2019-13615

Does anybody know why libebml wasn't fixed yet in Stretch?

Re: About the “Security Issue” on VLC

#149

Post by BasicObject »

jbk wrote: post #10
LeonM wrote: post #2

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.

> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...

I wanted to thank you for your work on VLC as well. It has been my go to video player for many years.

Re: About the “Security Issue” on VLC

#150

Post by mindslight »

Majromax wrote: post #131
ryanlol wrote: post #120

Earlier quoted context omitted.

Great, me too. But I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Charity is nice, but I’m not going to insist that you donate your whole paycheck!

> I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Do you want ham-fisted regulations? Because that's how you get ham-fisted regulations. Lawmakers analogize. All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service ann…

> All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service announcements

It doesn't even take that much - throwing around terms like "bad faith" and "legal liabilities" suffices to create a hostile legal regime through common law torts. I'm okay with socially condemning unilateral disclosure as a likely assholeish thing to do, as long as we acknowledge that being an asshole is perfectly legal.

I'm admittedly not up to speed on this particular soap opera, but it seems like the real blameful parties here are Gizmodo et al - scraping the bottom of the barrel for raw technical tidbits, and then escalating them into sensationalist "news" narrative rather than performing any sort of responsible interpretation.

Post reply on HN