Carrot Disclosure: Forgejo
dustri.org
Carrot Disclosure: Forgejo
1–10 of 60 posts
Re: Carrot Disclosure: Forgejo
#2The author's attitude is so off-putting. What gives? Did Forgejo hurt you?
The Forgejo disclosure process looked pretty simple and straightforward to me. The bold and all-caps words that bothered the author are just making sure you know how to disclose vulnerabilities safely without leaking zero-day exploits to a wider audience than necessary.
I'm also not impressed with a carrot disclosure that looks like this. Running a python script to compromise a locally hosted instance? Bruh, you have physical hardware and host shell access. That python script could be doing anything including running as root.
Show us the exploit hitting a remote server.
Re: Carrot Disclosure: Forgejo
#3From a linked PR (related to this RCE?), from a maintainer who closed it:
>Just thinking something not being used is not enough, even if it's a security sensitive topic
Linux kernel seems to disagree. This is a dangerously naive way to think of networked software in the AI age.
---
edit: I got hit with the "posting too fast" block again, so I'll reply to dangus here:
>While a remote host would further prove the claim, the person clearly claims it is RCE, not just CE. It would be quite the pie in the face if the author wrote a python script to take in an IP address but modified system files on the backend to create a stunt.
Re: Carrot Disclosure: Forgejo
#4Hopefully someone a little more.. pragmatic gets eyes on that linked PR.
Re: Carrot Disclosure: Forgejo
#5The author's attitude is so off-putting. What gives? Did Forgejo hurt you? The Forgejo disclosure process looked pretty simple and straightforward to me. The bold and all-caps words that bothered the author are just making sure you know how to disclose vulnerabilities safely without leaking zero-day exploits to a wider audience than necessary. I'm also not impressed with a carrot disclosure that looks like this. Runn…
Seriously, this author comes across as an absolute sore loser if this is the PR they are referring too:
https://codeberg.org/forgejo/forgejo/pulls/12283
Someone asking you to write a test for new code and then making this blog in response is just so pathetic.
Re: Carrot Disclosure: Forgejo
#6There’s an old cryptography story.
A cryptographer friend tells the story of an amateur who kept bothering him with the cipher he invented. The cryptographer would break the cipher, the amateur would make a change to “fix” it, and the cryptographer would break it again. This exchange went on a few times until the cryptographer became fed up. When the amateur visited him to hear what the cryptographer thought, the cryptographer put three envelopes face down on the table. “In each of these envelopes is an attack against your cipher. Take one and read it. Don’t come back until you’ve discovered the other two attacks.” The amateur was never heard from again.
https://www.schneier.com/crypto-gram/archives/1998/1015.html
Re: Carrot Disclosure: Forgejo
#7From a linked PR (related to this RCE?), from a maintainer who closed it: >Just thinking something not being used is not enough, even if it's a security sensitive topic Linux kernel seems to disagree. This is a dangerously naive way to think of networked software in the AI age. --- edit: I got hit with the "posting too fast" block again, so I'll reply to dangus here: >While a remote host would further prove the claim…
It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk!
Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs a lot further in getting what they want.
But the author's whole attitude is that Forejo is such a mess and it's barely worth their time to try and clean it up. Nobody's twisting their arm to contribute to an open source project that they don't even like!
From the perspective of Forgejo maintainers, the author is just some random new contributor barging in and telling them to drop some legacy support that hasn't been discussed in detail yet. And of course, this new contributor hasn't actually followed the security policy to disclose it as a high severity issue to justify the change.
Re: Carrot Disclosure: Forgejo
#8There’s an old cryptography story. A cryptographer friend tells the story of an amateur who kept bothering him with the cipher he invented. The cryptographer would break the cipher, the amateur would make a change to “fix” it, and the cryptographer would break it again. This exchange went on a few times until the cryptographer became fed up. When the amateur visited him to hear what the cryptographer thought, the cry…
And if you are a dishonest cryptographer, you only need to find one attack to pull this off.
Re: Carrot Disclosure: Forgejo
#9From a linked PR (related to this RCE?), from a maintainer who closed it: >Just thinking something not being used is not enough, even if it's a security sensitive topic Linux kernel seems to disagree. This is a dangerously naive way to think of networked software in the AI age. --- edit: I got hit with the "posting too fast" block again, so I'll reply to dangus here: >While a remote host would further prove the claim…
It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk! Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs…
Don’t forget, repeatedly ignoring the requirements for including tests, and instead offering up a “have tested it locally, trust me” as a substitute.
Re: Carrot Disclosure: Forgejo
#10From a linked PR (related to this RCE?), from a maintainer who closed it: >Just thinking something not being used is not enough, even if it's a security sensitive topic Linux kernel seems to disagree. This is a dangerously naive way to think of networked software in the AI age. --- edit: I got hit with the "posting too fast" block again, so I'll reply to dangus here: >While a remote host would further prove the claim…
It would definitely be a bit silly for the author to make a fake carrot disclosure, but I thought of it just because of how reading this article made me feel distrust toward the author. IDK, they just seem like kind of a jerk! Now, I don't think the PRs with the Forgejo folks show a lot of warm collaborative energy on their side, either, but I can see how soft skills from the author would likely have taken their PRs…
Idunno, I think this model of disclosure feels more natural to me. The "coordinated" model can have the smack of extortion to it.
And yes, I very much want there to exist people whose specialty is finding security bugs. I wouldn't expect such a person to be a diehard contributor to any particular project. Their motivation isn't making one tool better, but keeping users safe. We need those people and the work they do badly!