Top
Best
New

Posted by jwilk 6 days ago

Libxml2's "no security embargoes" policy(lwn.net)
298 points | 268 commentspage 3
ZiiS 5 days ago|
It seems perfectly reasonable for any library to take the stance they are not a security barrier. It is up to people using libxml2 in applications and OSs that have the resources to issue CVEs and track embargos. I am sure any resulting PRs will be gratefully welcomed.
anonzzzies 5 days ago||
We get so many 'security advisors' trying to blackmail us for money or blackmailing us to post on some social media that we don't care about security because we ignored their emails. A small company, let alone an opensource maintainer doesn't have time for this. Most of this stuff is just not priority or not valid for our case. We had some relief years ago when we changed our internal stuff to give off productnames and version numbers that simply don't exist, but because so much is frontend now tools are so good at finger printing that, so now we do get tons of those again.
jonathanlydall 5 days ago|
Someone who runs a small company with a static content website, got an email like this, I was thinking a response like the following might be a appropriate:

Thank you for reaching out to us. Please be aware that we do not run any kind of security bounty/reward programs.

Having performed our own analysis we have not been able to identify any practically exploitable security risks.

If you have found a practically exploitable security issue with our website, please provide some form of demonstration so that we may discuss further.

I don’t think that would come across as not being concerned about security, but puts the onus on the “researcher” to prove there is a real problem.

Chances are they did some automated scan and found some out of date JavaScript library version which despite having a vulnerability, is not actually a security risk on a static content site.

democracy 6 days ago||
funny - when struts2/log4j caused a lot of million-dollar problems, how many companies were looking for commercial alternatives or invested into developing their own solutions? That's right - zero. Everyone just switched to the next freebie.
benced 6 days ago||
Do we need a more profound solution than what the maintainer is doing here? Any given bug is either:

a) nonsense in which case nobody should spend any time fixing this (I'm thinking things like the frontend DDOS CVEs that are common) b) an actual problem in which case a compliance person at one of these mega tech companies will tell the engineers it needs to be fixed. If the maintainer refuses to be the person fixing it (a reasonable choice), the mega tech company will eventually just do it.

I suppose the risk is the mega tech company only fixes it for their internal fork.

prmoustache 5 days ago|
> I suppose the risk is the mega tech company only fixes it for their internal fork.

They'd rather send a patch than having to maintain and sync an internal fork with upstream.

mjw1007 6 days ago||
It would be better if there was a layer of maintainers between the free software authors and the end users that could act as a buffer in cases like this, in particular to take care of security vulnerabilities that genuinely need dealing with quickly.

Of course that's exactly what traditional Linux distributions signed up to do.

Clearly many people have decided that they're better off without the distributions' packaging work. But maybe they should be thinking about how to get the "buffering" part back, and ideally make it work better than the distributions managed to.

otikik 6 days ago||
I think they are not going far enough.

"All null-pointer-referencing issues should come with an accompanying fix pull request".

jeroenhd 6 days ago||
I don't think putting the burden to fix the code should be on users. However, it also shouldn't be on developers.

I think something like "Null-pointer-referencing issues will not be looked at by core maintainers unless someone already provides a patch". That way, someone else who knows how to fix the problem can step in, and users aren't left with the false impression that merely reporting their bug will not guarantee a solution.

pmlnr 5 days ago||
Not users. Security researchers.
tzs 6 days ago||
So if I find a null pointer dereference issue in something written in a language I don’t know, I shouldn’t report it because I can’t include a fix?
otikik 6 days ago||
If you don't know the language, why are you reporting null pointers?
tzs 6 days ago||
Because the program crashed and the crash dump showed a null pointer dereference, and I found some inputs that reproduce it 100%, so I thought this might be useful to the developer?
otikik 6 days ago||
In the context of libxml it does sound that for every hypothetical person like you that there's going to be 20 "security researchers" like the ones the article is mentioning; just running automated tools and trying to use security issues as a way to promote themselves.

If getting rid of your input gets rid of the other 20 issues, I would take it.

sim7c00 5 days ago||
its so weird to me to report a bug to open source but not atleast suggest a fix :/. especially around security bugs. to prove it u need to reliably trigger and exploit it so it should be plainly obvious in most cases what the fix is :/.

this is why i never report stuff to open source. if you wanna play bug bounty and cve hoarder its better to stick with bug bounty programs.

why? there the security researcher can be depressed about the process himself rather than some volunteer coder. gotta not make your issues other ppls issues.

leoh 5 days ago||
I wonder if fil c would make most of these issues go away

https://github.com/pizlonator/llvm-project-deluge

KingOfCoders 6 days ago||
When a project is up, open source developers are keen to promote it, put it on their CV, give conference talks. There is no obligation for companies to sponsor anything, this is not the reason behind open source.

Yes open source has changed, from when the early 90s. There are more users, companies use projects and make millions with other peoples work.

I feel with the maintainer, with how ungrateful people are. And demanding without giving.

Open Source licenses fall short.

Open Source projects should clearly state what they think about fixing security, taking on external contributions or if they consider the project feature complete. Just like standard licenses, we should have a standard, parseable maintenance "contract".

"I fix whatever you pay for, I fix nothing, I fix how I see fit. Including disclosure, etc."

So everyone is clear about what to expect.

yencabulator 5 days ago|
That's in the license already, and quite clear.

https://gitlab.gnome.org/GNOME/libxml2/-/blob/63f98ee8a3a11f...

KingOfCoders 5 days ago||
It's not, license just says "Nothing guaranteed", it's not saying what to expect. A "I can do whatever I want" doesn't tell you anything about my behavior.

"The viewpoint expressed by Wellnhofer's is understandable, though one might argue about the assertion that libxml2 was not of sufficient quality for mainstream use. It was certainly promoted on the project web site as a capable and portable toolkit for the purpose of parsing XML. Open-source proponents spent much of the late 1990s and early 2000s trying to entice companies to trust the quality of projects like libxml2, so it is hard to blame those companies now for believing it was suitable for mainstream use at the time."

If the license says one thing, and you say and promote something else, you can't say "But it's in the license" and "I said so at a conference" just as it fits you.

So what should I believe? What you write in the license? What you say at a conference? Nothing you say?

yencabulator 4 days ago||
You should believe that at best you can get a refund for the price you paid.

I think the software I wrote is pretty great, but I sure don't want to be liable for the things you do with it.

KingOfCoders 3 days ago||
No it's totally fine to not get support, but what the maintainer says in articles and conferences, should be what they do. If you only fix bugs as you see fit, say so. The licenses covers the liability, which this is not about.
More comments...