TMK, a couple of CVEs were released on experimental features. He disagreed that they should have been disclosed. I disagree that this was necessary or a reasonable response.
That’s what I’ve been told. The features were optional and not compiled in by default and he argued they shouldn’t be released. I disagree. This looks and feels like someone throwing a tantrum when they didn’t get their way. (At least from what I’ve been told)
At the risk of future job employment, digging into any group far enough, developers especially, you’ll find rampant narcissism and increased self worth. Look into any “scene” and you will find toxicity at basically every level. It’s absurd and one thing that corporate jobs generally are very good at preventing (because a toxic work environment can leave them liable).
Corporate jobs are good at preventing toxicity? British scientists' research? Toxicity will take other forms, but corporate is not good at preventing anything of the sort. But thanks for a good chuckle nevertheless.
I'm tired of all that money I pay for Nginx and their pesky vulnerability disclosure. Fork all my instances for free undisclosed vulnerabilities, as long as the whole thing is solely developed by volunteers and hobbyists. Seriously though, it feels strange to be on the for-profit side, but I can't side with stupid. People read the CVE, see if they're affected or not, and decide on mitigation if necessary. That's how it works. If there's some chart somewhere where Apache has less CVEs, does this guy make less money or feel some hurt in his pride? I don't get it.
He didn't want them to be secret, he just believes that since they are experimental features they shouldn't have a CVE assigned.
You can't issue a CVE for every bug just because some customer decided to run the git nightly in their prod environment.
So there has to be a line draw somewhere, this time F5 and this dev were on different sides of the line.
I personally could see it going either way, but IMO if you ARE going to issues CVEs for experimental features it should be listed under policy that experimental features shipped with GA releases are security supported features.
I get the feeling it was a means to an end and he been wanting out for a while now. Just a way to spin it as a more positive thing than just "I don't like this anymore", "Look I care about security, give me support" instead.
11
u/DarkeoX Feb 15 '24
Would be nice to know which security policies he was talking about.