141–150 of 217 posts
Earlier quoted context omitted.
... and an announcement like this is a fairly strong message of "assume you need to care"
I'm not going to assume anything in regards to a future release I have no details about.
Seriously, what are you complaining about?
Earlier quoted context omitted.
I'm not going to assume anything in regards to a future release I have no details about.
So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
Earlier quoted context omitted.
So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
Earlier quoted context omitted.
I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
> I just want actionable information Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
Earlier quoted context omitted.
So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
This is basically useless without identifying the vulnerability.
Clearly some people prefer to know in advance, to make sure they're prepared to patch critical servers on that day, and perhaps even take some offline until then.
Earlier quoted context omitted.
> I just want actionable information Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
I'm not yet convinced there's a problem.
From an open-source project...
That has a history of major security vulnerabilities...
Because there's no detailed information yet...
When industry best practice is to not give detailed information without a patch or workaround...
And they're giving you a heads-up for required mitigation in three days...
Rather than right now...
Earlier quoted context omitted.
I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
"be prepared to update affected systems at $point_in_time" seems actionable to me. You for some reason thinking that such a warning doesn't warrant taking the recommended action doesn't mean it isn't actionable, it means you choose to ignore it.
Earlier quoted context omitted.
I'm not yet convinced there's a problem.
You're not convinced? About a security vulnerability... From an open-source project... That has a history of major security vulnerabilities... Because there's no detailed information yet... When industry best practice is to not give detailed information without a patch or workaround... And they're giving you a heads-up for required mitigation in three days... Rather than right now...
Earlier quoted context omitted.
Indeed - this is one of the positives of Go, as all the dependencies get linked statically, giving nice portable "single binary" solutions. Grepping function names seems a reasonable approach, as long as you're not trying to detect something that is obfuscating its use of libssl (i.e. by mangling strings together). It appears if you strip a binary, any definitive information about the libraries linked in statically i…
Unsure why people keep referring to static linking as a positive in this thread? Downstream consumers of statically-linked binaries have no practical way to scan their systems for known-vulnerable versions of libraries, that seems a profoundly negative consequence to me.