21–30 of 32 posts
Earlier quoted context omitted.
The patch was supposed to be published around 06:00 UTC on October 11. The commit is 13 hours early.
Perhaps, but to be honest trying to coordinate times on a specific disclosure day is futile. I would imagine Daniel is aware of this phenomenon.
It's a valid question.
Earlier quoted context omitted.
Perhaps, but to be honest trying to coordinate times on a specific disclosure day is futile. I would imagine Daniel is aware of this phenomenon.
> When there is a HIGH CVE security flaw, why then not release immediately after fix has been applied, but at a set date? It's a valid question.
Usually ubiquitous projects like this will privately distribute patches to large distros or corps so they can push security updates or at least prepare to push them on the disclosure date so that risk of exploit is lower by the date of disclosure. Otherwise there would be a lag and people would be more exposed for a period after disclosure.
cURL's own tracker had a banner stating severity High to be released October 11. It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked. EDIT: Why the downvotes? People don't like timezones or something?
> The new version and details about the two CVEs will be published around 06:00 UTC on the release day. https://github.com/curl/curl/discussions/12026 (2023-10-04T06:17:44Z)
Will people stop messing with unsafe buffers in C already? Even just using C++ with the most basic buffer/dynamic array template would have prevented this issue.
While I agree with the general thrust of your comment, note that a) this is specifically adressed in Daniel's blog post b) He stated the reason why it's not happening right now multiple times already, and they seem well thought out. (Basically, the code base is huge and not easily converted, and there is no compiler support for some of the platforms libcurl supports). Engineering is based on trade offs. In this speci…
> and there is no compiler support for some of the platforms libcurl supports
I feel like there are no serious platforms that don't have at least a C++ compiler for it. Or am I wrong there?
Earlier quoted context omitted.
> The new version and details about the two CVEs will be published around 06:00 UTC on the release day. https://github.com/curl/curl/discussions/12026 (2023-10-04T06:17:44Z)
That has to do with curl itself , redhat isn't necessarily bound to that schedule and we don't know the discussion that happened privately prior to disclosure date.
Along the lines of "they've proven they can't be trusted", kind of thing.
Earlier quoted context omitted.
That has to do with curl itself , redhat isn't necessarily bound to that schedule and we don't know the discussion that happened privately prior to disclosure date.
That kind of approach leads to the party which broke ranks this time, not being included in confidential things in future. Along the lines of "they've proven they can't be trusted", kind of thing.
Earlier quoted context omitted.
That kind of approach leads to the party which broke ranks this time, not being included in confidential things in future. Along the lines of "they've proven they can't be trusted", kind of thing.
I don't agree they broke ranks. The 6am date was for the curl project itself.
Earlier quoted context omitted.
There are tons of shady open or semi-open proxies out there.
There's also PAC/WPAD ( https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Proto... ). Together with some DHCP/ARP/DNS spoofing this might allow escalating from layer 2 connectivity (e.g. on a public wifi) to local root.
Earlier quoted context omitted.
I don't agree they broke ranks. The 6am date was for the curl project itself.
Probably depends on whether Red Hat was party to privileged info as part of a co-ordinated release for this. Personally, I have no idea.
Earlier quoted context omitted.
> The new version and details about the two CVEs will be published around 06:00 UTC on the release day. https://github.com/curl/curl/discussions/12026 (2023-10-04T06:17:44Z)
That has to do with curl itself , redhat isn't necessarily bound to that schedule and we don't know the discussion that happened privately prior to disclosure date.