a6a6217322
Remove closed bugs and todos that were last edited or commented before 2020. Except for ones tagged projects/* since projects like datalad want to keep around records of old deleted bugs longer. Command line used: for f in $(grep -l '|done\]\]' -- ./*.mdwn); do if ! grep -q "projects/" "$f"; then d="$(echo "$f" | sed 's/.mdwn$//')"; if [ -z "$(git log --since=01-01-2020 --pretty=oneline -- "$f")" -a -z "$(git log --since=01-01-2020 --pretty=oneline -- "$d")" ]; then git rm -- "./$f" ; git rm -rf "./$d"; fi; fi; done for f in $(grep -l '\[\[done\]\]' -- ./*.mdwn); do if ! grep -q "projects/" "$f"; then d="$(echo "$f" | sed 's/.mdwn$//')"; if [ -z "$(git log --since=01-01-2020 --pretty=oneline -- "$f")" -a -z "$(git log --since=01-01-2020 --pretty=oneline -- "$d")" ]; then git rm -- "./$f" ; git rm -rf "./$d"; fi; fi; done
27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
I'm writing this on a private branch, it won't be posted until a week from
|
|
now when the security hole is disclosed.
|
|
|
|
Security is not compositional. You can have one good feature, and add
|
|
another good feature, and the result is not two good features, but a new
|
|
security hole. In this case
|
|
[[security/CVE-2018-10857_and_CVE-2018-10859|CVE-2018-10857]].
|
|
And it can be hard to spot this kind of security hole, but then once it's
|
|
known it seems blindly obvious.
|
|
|
|
It came to me last night and by this morning I had decided the potential
|
|
impact was large enough to do a coordinated disclosure. Spent the first
|
|
half of the day thinking through ways to fix it that don't involve writing
|
|
my own http library. Then started getting in touch with all the
|
|
distributions' security teams. And then coded up a fairly complete fix for
|
|
the worst part of the security hole, although a secondary part is going to
|
|
need considerably more work.
|
|
|
|
It looks like the external special remotes are going to need at least some
|
|
security review too, and I'm still thinking that part of the problem over.
|
|
|
|
Exhausted.
|
|
|
|
Today's work was sponsored by Trenton Cronholm
|
|
[on Patreon](https://patreon.com/joeyh).
|
|
|
|
[[!meta date="Jun 15 2018 7:00 pm"]]
|