It is. The vuln itself was found with guidance of an AI tool. Doesn’t make the vuln any less bad. Does make Xint look really shitty for constantly shilling with boilerplate AI instead of a good human analysis (or at least something above boilerplate).
The only guaranteed fix is in the kernel. You’ll want to check your distro for the CVE. The disclosers very happily bring up all the distros affected but do not seem to have reached out to any of them to also patch. The CVE itself is still waiting for NVD analysis beyond its base score.
I’m not actively saying they did anything wrong but I am saying they’re blowing smoke about responsible disclosure.
I think you’re displaying a very big gap between understanding risk assessment and understanding task completion. So far I have not seen anyone say they would not complete the task. I have seen people complete risk assessment. Risk assessment does not mean I will not do something, it just reflects the urgency with which I will do it. Most self-hosted users can safely apply basic risk assessment to see, while the impact may be high, the likelihood is low. Obviously the likelihood increases the more hands off you are with, say, unattended container updates for things that can escape containers or access the underlying system. Should most self-hosted users literally drop everything, rush home, and apply the patch? No, basic risk assessment does not merit that. Should everyone apply the patch? Yes.
Your comment said Forgejo has a disclosure process. The article says the author went with a carrot disclosure after reading the disclosure process and making a value judgement. Because your comment only mentioned Forgejo having a disclosure process, not an evaluation of the author’s evaluation of the disclosure process, it made you appear as if you had not read the article.
In your response to me calling that out, you offer an analysis. The author is lazy for using carrot disclosure over the defined disclosure process. That’s a valid take. I’m not going to disagree with that.
I don’t think you read the article.
Forgive me, I’m not super versed on Dewey’s mathematics ideas. Quick skimming of some articles and papers seems to suggest he was very practical and wanted kids to tie into the real world. How does that differ from the pink side? Both, to me, seem the opposite of classical logic training.
I dislike scam money as much as the next person. I do not, however, dislike cryptography. There’s a really good common in the thread about elliptic curve cryptography not having a place on Codeberg anymore and I think that’s valid. I don’t even know if OpenSSL could have a place on Codeberg with this decision. Their nonprofit, their rules. Just not very libre-minded and definitely sets a bad precedent. And before someone tells me Microsoft actively censors GitHub, this isn’t a whataboutism thread. It just reduces my trust in a supposedly open collective.