Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by xs_kid | Hacker News Reader

Full thread

xs_kid·

- No CVE.

- Distributions weren't contacted prior the release.

- Everyone can see the diff for the fix in the codebase.

- There are a PoC as test-case in the code.

- The release was done in the start of weekend when everyone in America is leaving the office and everyone in Europe is sleeping.

- A big part of the community is in two conferences right now.

IMHO that was the worst way to provide a security update.

View on HN

The initial report was made publicly, including a proof of concept exploit, and is currently viewable via google cache. The censored issue report is referenced with a metasploit pull request containing code that can be used to exploit.

Given this, I'd say sooner is better than later.

It would be prudent to mention making your load balancer limit the number of requests than can be pipelined down a single connection should resolve any issue.

The metasploit exploit was possible only thanks to the release (see the tweets of metasploit maintainer @hdmoore), IMO they could have waited until Monday morning to release it.

While the security update protocol leaves something to be desired, the possibility of a DoS attach is not quite as bad as a vulnerability that leaks real information. If that were to happen, I'd hope all the steps you've outlined would be followed.

Agreed, however it would be nice to test and reinforce those steps at a time like this when they're not as crucially important.

What conferences?

JSConfCo: http://jsconf.co/

RealtimeConf: http://2013.realtimeconf.com/

Boohoo; 1 or 2 Hubots and Ghost blogs might crash over the weekend. If you're as paranoid as you seem to be, you have someone on call to fix this and wouldn't have dared to have put such an untested technology out in the wild.

Reply on news.ycombinator.com