So just to clarify because its as clear as mud, 8.7 is still affected so we are waiting for an update ?
Yes.
GitLab Major Security Update for CVE-2016-4340
21–30 of 45 posts
Re: GitLab Major Security Update for CVE-2016-4340
#22It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening:
- They are very open about security vulnerabilities and fix them fast.
- There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently.
I'd like to believe it's the first.
EDIT: formatting.
Re: GitLab Major Security Update for CVE-2016-4340
#23why do they release it at 5pm PDT? A lot of people are leaving work on the west coast. The rest of the country people are home eating dinner. EU is sleeping. Really stupid time.
Its probably the most convenient window to minimise service disruption amongst users of gitlabs. Pretty common for security patches to take place out of hours
Unless it creates a 'thundering herd', everyone downloading the update simultaneously, killing throughput.
Re: GitLab Major Security Update for CVE-2016-4340
#24It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening: - They are very open about security vulnerabilities and fix them fast. - There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently. I'd like to believe it's the first. EDIT: formatting.
Why not both?
Re: GitLab Major Security Update for CVE-2016-4340
#25No details, just like the posts about this yesterday. Obligatory 'check our blog later for more.'
That's pretty much the only way to do a security update for something people are going to want to patch asap. warn people in advance it's coming so they can be ready to apply when released, without giving away any details that might help someone find the exploit before it comes.
Re: GitLab Major Security Update for CVE-2016-4340
#26Earlier quoted context omitted.
Its probably the most convenient window to minimise service disruption amongst users of gitlabs. Pretty common for security patches to take place out of hours
Unless it creates a 'thundering herd', everyone downloading the update simultaneously, killing throughput.
Handling large volume of downloads of one static large package is in general a pretty solved problem.
Re: GitLab Major Security Update for CVE-2016-4340
#27It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening: - They are very open about security vulnerabilities and fix them fast. - There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently. I'd like to believe it's the first. EDIT: formatting.
> Now there are two reasons I can think of this happening
They are also churning at a pretty insane rate due their release schedule. I did a very basic analysis of their repos at
http://gitsense.github.io/blog/motion-bubble-charts.html
And this is the churn for this month in their master and 8-7-stable branch
I also included the https://github.com/atom/atom master branch (blue line) for comparison.
In order to get a better picture what what's going on, I'll need to cross reference the churn to security issues, but this isn't something my tool will support until later in the year.
Re: GitLab Major Security Update for CVE-2016-4340
#28No details, just like the posts about this yesterday. Obligatory 'check our blog later for more.'
That's pretty much the only way to do a security update for something people are going to want to patch asap. warn people in advance it's coming so they can be ready to apply when released, without giving away any details that might help someone find the exploit before it comes.
They could say what the exposure is. If it's just "your private repos are exposed" then it wouldn't be urgent to patch a public server, for example.
Re: GitLab Major Security Update for CVE-2016-4340
#29It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening: - They are very open about security vulnerabilities and fix them fast. - There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently. I'd like to believe it's the first. EDIT: formatting.
You probably perceive GitLab as having more vulns because we're a very open company, whereas most other companies keep it mostly to themselves.
Relevant: https://twitter.com/tenderlove/status/725370404513017856
Re: GitLab Major Security Update for CVE-2016-4340
#30Earlier quoted context omitted.
That's pretty much the only way to do a security update for something people are going to want to patch asap. warn people in advance it's coming so they can be ready to apply when released, without giving away any details that might help someone find the exploit before it comes.
They could say what the exposure is. If it's just "your private repos are exposed" then it wouldn't be urgent to patch a public server, for example.
Let's hope it's not remote code execution on the CI daemons.