Comment by dvtrn | Hacker News Reader

Comment by dvtrn | Hacker News Reader

Parent Full thread

The response seems … snippy:

Am I missing something?

It does appear from the link you provided that the maintainers regressed back across the last three major releases and also couldn't reproduce the issue, and I suspect their snippiness is coming from Gizmodo's[1] haste to publish an article asserting that their product contained vulnerabilities when it so far cannot be proved to.Possibly even the assertion that "VideoLAN is also aware of the issue and is currently working on a patch, though right now" which has me wondering:

Did anyone at Gizmodo actually read the issue tracker to see the testing done by JBK?

I'd be a bit annoyed and prone to snippiness at this kind of reporting about my code in a major online publication as well, honestly.

---

[1] https://gizmodo.com/you-might-want-to-uninstall-vlc-immediat...

That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to have prepared an exploit. The bug itself (which perhaps is all the VLC people are looking at, aside from the news, now?) is pretty bare bones.

I too have no idea where Gizmodo is getting the notion that it is being worked on. Perhaps they're getting that from the failed reproduction attempts.

Judging from the statement:

VideoLAN is also aware of the issue and is currently working on a patch, though right now

I'm going to guess someone quickly glanced at the issue tracker, saw a percentage of work done and presumed "vulnerability: valid" and pressed on with publication without bothering to try reaching JBK for comment. Both sites really ought to update their posts for clarity.

Terrible form, IMO --in the interest of security disclosures.

VideoLAN does not seem amused about it either: https://twitter.com/videolan/status/1153715138333220864

They probably read the third comment, Component: Demuxers → Demuxers: MKV Work status: 60% → Not started

Reply on news.ycombinator.com