Hacker News Reader

Comment by tagraves | Hacker News Reader

It's really concerning that the biggest, most eye-grabbing part of this posting is the note with the following: "It’s common for critical CVEs to uncover follow‑up vulnerabilities."

Trying to justify the CVE before fully explaining the scope of the CVE, who is affected, or how to mitigate it -- yikes.

View on HN

What’s concerning about it? The first thing I thought when I read the headline was “wow, another react CVE?” It’s not a justification, it’s an explanation to the most obvious immediate question.

It's definitely a defensive statement, proactively covering the situation as "normal". Normal it may be, but emphasizing that in the limited space of a tweet thread definitely indicates where their mind is on this, I'd think.

Are you reading a different link? This statement is on a React blog post, not a Twitter thread.

But it is another React CVE. Doesn't really matter why it was uncovered, it's bad that it existed either way

an insecure software will have multiple CVEs, not necessarily related to each other. Those 3 are probably not the only ones.

Thanks for the feedback, I adjusted it here so the first note is related to the impacted versions:

https://github.com/reactjs/react.dev/pull/8195

I appreciate the follow up! I think it looks great now and doesn’t read as defensively anymore!

Yeah agreed, thanks again for the feedback. The priority here is clear disclosure and upgrade steps.

Perception management

https://en.wikipedia.org/wiki/Perception_management

Also kind of funny that they're comparing it to Log2Shell. Maybe not the best sort of company to be keeping...

React is the new JavaBean

Welcome to the React, Next, Vercel ecosystem. Our tech may be shite but we look fancy.

The Vercel CEO post congratulating his team for how they managed the vulnerability was funny

There are a lot of careers riding on the optics here.

No, there aren't. The react team isn't going to axe half the team because there's a high severity CVE.

I think the same. To me it looks like a Vercel marketing employee wrote that.

Very standard in security, announcements always always always try to downplay their severity.

fwiw, the goal here wasn't to downplay the severity, but to explain the context to an audience who might not be familiar with CVEs and what's considered normal. I moved the note down so the more important information like severity, impacted versions, and upgrade instructions are first.

> an audience who might not be familiar with CVEs

If there are so many React developers out there using server side components while not familiar with the concept of CVEs, we’re in very serious trouble.

It's ok, you gotta play the game. I'm more concerned about the fact that the downtime issue ranks higher than the security issue. But I'm assuming it relates to the specifics of the issue rather than reflecting on the priorities of the project as a whole.

Reply on news.ycombinator.com