Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Forgejo <=16.0.3 Critical RCE

codeberg.org

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Forgejo <=16.0.3 Critical RCE

#41

Post by kstrauser »

innocent_name wrote: post #23

The opex and security fine costs of moving off managed services like GitHub/GitLab are catching up.

This vulnerability, which doesn’t affect my installation, would take approximately 5 minutes to patch if it did. With that exception, my server will have had approximately 99.999% uptime over the last several years.

It would take a boatload of such events to equal the opex of GitHub hosting. That’s not an excuse to run amok, but it’s far from tipping the scales in GitHub’s cost favor.

Re: Forgejo <=16.0.3 Critical RCE

#43

Post by embedding-shape »

mmsc wrote: post #42

Wonder how long it took from report to patch. IME codeberg has one of the rudest security teams in oss (fair enough or not, irrelevant). https://news.ycombinator.com/item?id=47941590 Is quite relevant

Is that linked submission "your experience" or is there something else you're basing that on? Because that article you linked is kind of strange, read through the comments on what you linked.

Re: Forgejo <=16.0.3 Critical RCE

#44

Post by mfenniak »

mmsc wrote: post #42

Wonder how long it took from report to patch. IME codeberg has one of the rudest security teams in oss (fair enough or not, irrelevant). https://news.ycombinator.com/item?id=47941590 Is quite relevant

Forgejo's security team received disclosure of this issue on September 4th. (source: I am a member of that team)

Re: Forgejo <=16.0.3 Critical RCE

#45

Post by jonstaab »

embedding-shape wrote: post #38
tredre3 wrote: post #19

Earlier quoted context omitted.

> Gitea is protected against both of these issues. Is Gitea's immunity just incidental because it was written by a different person, or is it due to a deliberate defensive system that prevents such bug/mistake from occurring?

Very interested in knowing too, since the issues seems to not be related at all, or similar, so now this must mean a Gitea "project leader" would only say this if they have some sort of layer that doesn't require them to manually patch issues individually. Meaning, firewall? Would be weird if that's built-in into Gitea though... Hmm.

Forgejo is a fork of gitea.

Re: Forgejo <=16.0.3 Critical RCE

#46

Post by pixl97 »

bdcravens wrote: post #20
keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Why can't you use an LLM to find vulnerabilities and then hand-code the fix? You don't even have to clean-room implement it; let the LLM write the code, and then reimplement, doing what you can to de-LLM-ify it.

You can, though some people are going to be annoyed by it and just publish a zero day out of spite.

Re: Forgejo <=16.0.3 Critical RCE

#47

Post by pixl97 »

rvz wrote: post #33

As I said before for patching vulnerabilities in the age of AI [0], attackers are going to build exploits around this RCE with AI or even find more flaws with AI. This means you have no choice but to use AI to defend, find and patch these flaws before attackers quickly build and use these exploits to target users. You cannot afford to disallow or have a 100% ban on LLM contributions while attackers do not care and wi…

If nothing else having AI review anything security related may be a good idea.

Re: Forgejo <=16.0.3 Critical RCE

#48

Post by dabeeeenster »

techknowlogick wrote: post #18

Only posting here because I've been asked about it. Gitea is protected against both of these issues. (bias note: part of project leadership of Gitea) Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.

Your note is really important! Thanks for adding it. None of us are perfect.

Re: Forgejo <=16.0.3 Critical RCE

#49

Post by ThePowerOfFuet »

jonstaab wrote: post #45
embedding-shape wrote: post #38

Earlier quoted context omitted.

Very interested in knowing too, since the issues seems to not be related at all, or similar, so now this must mean a Gitea "project leader" would only say this if they have some sort of layer that doesn't require them to manually patch issues individually. Meaning, firewall? Would be weird if that's built-in into Gitea though... Hmm.

Forgejo is a fork of gitea.

Hence the question...

Re: Forgejo <=16.0.3 Critical RCE

#50

Post by cmrdporcupine »

otherme123 wrote: post #14
keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Was this discovered by AI? Is all AI code 100% free of bugs? You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum. Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is…

> You are implying that just by allowing LLM contributions your product is free of bugs

That... is not the implication of the comment you're replying to.

You don't need to make it all fundamentalist.

Post reply on HN