Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Carrot Disclosure: Forgejo

dustri.org

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Carrot Disclosure: Forgejo

#11

Post by conartist6 »

chillfox wrote: post #9
dangus wrote: post #7

Earlier quoted context omitted.

It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk! Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs…

Don’t forget, repeatedly ignoring the requirements for including tests, and instead offering up a “have tested it locally, trust me” as a substitute.

The worry here is that they need to leave the security hole open because they're using it?

Re: Carrot Disclosure: Forgejo

#13

Post by onedognight »

shimman wrote: post #5
dangus wrote: post #2

The author's attitude is so off-putting. What gives? Did Forgejo hurt you? The Forgejo disclosure process looked pretty simple and straightforward to me. The bold and all-caps words that bothered the author are just making sure you know how to disclose vulnerabilities safely without leaking zero-day exploits to a wider audience than necessary. I'm also not impressed with a carrot disclosure that looks like this. Runn…

Seriously, this author comes across as an absolute sore loser if this is the PR they are referring too: https://codeberg.org/forgejo/forgejo/pulls/12283 Someone asking you to write a test for new code and then making this blog in response is just so pathetic.

To hell with writing a test for you. That’s what you say to someone who gets paid by you. If the project doesn’t want the fix. That’s their issue, not the reporter’s.

Re: Carrot Disclosure: Forgejo

#14

Post by martey »

shimman wrote: post #5
dangus wrote: post #2

The author's attitude is so off-putting. What gives? Did Forgejo hurt you? The Forgejo disclosure process looked pretty simple and straightforward to me. The bold and all-caps words that bothered the author are just making sure you know how to disclose vulnerabilities safely without leaking zero-day exploits to a wider audience than necessary. I'm also not impressed with a carrot disclosure that looks like this. Runn…

Seriously, this author comes across as an absolute sore loser if this is the PR they are referring too: https://codeberg.org/forgejo/forgejo/pulls/12283 Someone asking you to write a test for new code and then making this blog in response is just so pathetic.

While I agree with you that this blog post (and the "carrot disclosure" described in it) is ill-considered, the pull request is not really "new code", it adds quotes to HTML attributes that are missing them. I think it's entirely reasonable for a contributor to assume that a new test case would not be needed for this small change, and that the maintainer's response ("So a simple question: is this code covered under a test? If not, you will have to add one.") is more abrasive than necessary.

Re: Carrot Disclosure: Forgejo

#15

Post by jorams »

This is a weird post to be honest. You've found a whole bunch of serious security issues, filed two PRs, one of which is adding some quotes because

> Those aren't exploitable XSS, but it doesn't hurt to have a second layer of defense.

The other suggests breaking clients that aren't using the more secure version of an OAuth method because

> I can't think of any OAuth client that would like to [use it]

That second one is a good idea, but the maintainer is also right to ask for some discussion before introducing a breaking change.

But crucially: neither of these are the kind of significant security issues you've found. Maybe lead with an actual bug?

Re: Carrot Disclosure: Forgejo

#16

Post by JuniperMesos »

dangus wrote: post #7
unethical_ban wrote: post #3

From a linked PR (related to this RCE?), from a maintainer who closed it: >Just thinking something not being used is not enough, even if it's a security sensitive topic Linux kernel seems to disagree. This is a dangerously naive way to think of networked software in the AI age. --- edit: I got hit with the "posting too fast" block again, so I'll reply to dangus here: >While a remote host would further prove the claim…

It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk! Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs…

> But the author's whole attitude is that Forejo is such a mess and it's barely worth their time to try and clean it up. Nobody's twisting their arm to contribute to an open source project that they don't even like!

> From the perspective of Forgejo maintainers, the author is just some random new contributor barging in and telling them to drop some legacy support that hasn't been discussed in detail yet. And of course, this new contributor hasn't actually followed the security policy to disclose it as a high severity issue to justify the change.

It does affect my own willingness to use Forgejo, as a current non-user. It sounds like it has some security vulnerabilities that the maintainers aren't taking seriously, perhaps because they think the people who report those vulnerabilities are jerks. Are the Forgejo maintainers themselves sure that their software isn't going to get pwned in a way they don't have the right techniques to mitigate? I'd rather know that before I run it on my own infra.

Re: Carrot Disclosure: Forgejo

#17

Post by gchamonlive »

In the age of AI, carrot disclosure is potentially a full disclosure with extra steps. I'm no security expert, but with the context provided, the forgejo codebase and the outline of the redacted script, I think there is a good chance I could use codex to crunch through the vuln chain and reproduce the script.

Re: Carrot Disclosure: Forgejo

#18

Post by Chris2048 »

shimman wrote: post #5
dangus wrote: post #2

The author's attitude is so off-putting. What gives? Did Forgejo hurt you? The Forgejo disclosure process looked pretty simple and straightforward to me. The bold and all-caps words that bothered the author are just making sure you know how to disclose vulnerabilities safely without leaking zero-day exploits to a wider audience than necessary. I'm also not impressed with a carrot disclosure that looks like this. Runn…

Seriously, this author comes across as an absolute sore loser if this is the PR they are referring too: https://codeberg.org/forgejo/forgejo/pulls/12283 Someone asking you to write a test for new code and then making this blog in response is just so pathetic.

> Someone asking you to write a test for new code

per the response: "I'm not sure what kind of test would you like me to write for this change, as it's simply adding 4 quotes"

Re: Carrot Disclosure: Forgejo

#19

Post by jorams »

JuniperMesos wrote: post #16
dangus wrote: post #7

Earlier quoted context omitted.

It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk! Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs…

> But the author's whole attitude is that Forejo is such a mess and it's barely worth their time to try and clean it up. Nobody's twisting their arm to contribute to an open source project that they don't even like! > From the perspective of Forgejo maintainers, the author is just some random new contributor barging in and telling them to drop some legacy support that hasn't been discussed in detail yet. And of cours…

> It sounds like it has some security vulnerabilities that the maintainers aren't taking seriously

It may, and they may or may not, but the author hasn't actually reported any. They're explicitly ignoring the security policy and vagueposting instead.

Re: Carrot Disclosure: Forgejo

#20

Post by stock_toaster »

mmsc wrote: post #12

https://codeberg.org/forgejo/governance/src/commit/5c07b3801... > Failure to comply with these rules will be criticized publicly, and we reserve the right to no longer coordinate with you or your project in the future. lol

I could totally imagine this kind of thing being added due to AI-slop security report overload, like curl was experiencing[1].

[1]: https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...

Post reply on HN