Zagorath

@Zagorath@aussie.zone

Formerly /u/Zagorath on the alien site.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Lemmy Security Advisory for Versions < `0.19.1`: Private message details leak. (github.com)

The full description of the bug is in the linked issue above, but the short version is:...

Zagorath, 1 year ago

As far as I’m aware the most widely-accepted standard for responsible disclosure is 90 days. This is a little different, since that’s normally between businesses and includes the time needed to develop a solution; it’s not typically aimed at federated or self-hosted applications rolling out an already-created patch. On the one hand, granting them that extra time to upgrade seems reasonable. On the other, wouldn’t anyone wanting to exploit a vulnerability be able to reverse-engineer it pretty easily by reading the git history?

I dunno where I land on this, tbh.

reply

report

activity

copy /kbin url

copy original url

open original url

Loading...