From my understanding, the impetus was that F5 submitted a CVE for a vulnerability, for an optional, “beta” feature that can be enabled. Dounin did not think a CVE should be submitted, since he did not considered it to be “production” feature.
That said, the vulnerability is in shipping code, regardless of whether it is optional or not, so per industry coding practices, it should either be patched or removed entirely in order to resolve the issue.
The messaging around this so far doesn't lead me to want to follow the fork on production. As a sysadmin I'm not rushing out to swap my reverse proxy.
The problem is I'm speculating but it seems like the developer was only continuing to develop under condition that they continued control over the nginx decision making.
So currently it looks like from a user of nginx, the cve registration is protecting me with open communication. From a security aspect, a security researcher probably needs that cve to count as a bug bounty.
From the developers perspective, f5 broke the pact of decision control being with the developer. But for me, I would rather it be registered and I'm informed even if I know my configuration doesn't use it.
Again, assuming a lot here. But I agree with f5. That feature even beta could be in a dev or test environment. That's enough reason to know.
Edit:Long term, I don't know where I'll land. Personally I'd rather be with the developer, except I need to trust that the solution is open not in source, but in communication. It's a weird situation.
Frivolous CVEs aren't a good thing for security. This bug was a possible DOS (not e.g. a privilege escalation) in a disabled-by-default experimental feature. It wasn't a security issue and should have been fixed with a patch instead of raising a false alarm and damaging trust.
It is WAY better to over report than under report. I don't want vendors to have a lot of ability to say "nope that's not a security problem, sweep it under the rug".
To a point. Ever heard of the boy who cried wolf?
"What if the boy who cried wolf got lucky and didn't get eaten in the end"? Seems to have missed the point of the parable a bit.
"A liar who lies repeatedly won't be believed" is definitely equivalent to "A company conservatively warned that one of their products was dangerous in some specific situations."
Hanging out with you sounds really fun.
That's... not the point either. The point is that "reporting false positives isn't a bad thing" is only true up to a point. The discussion is then "is this before or after that point." Which, given the context of the bug, isn't really a given. But I don't want to have that discussion with you anymore because you're annoying.
I am annoying, but something being low-risk and not effecting most customers doesn't make it a "false positive".
If only we were still having the conversation.
This comment really crystallizes your nerd subtype. I may be a [6] but you from arguing with you, ya sound cute 💜
Enjoy your selfhosting journey!
I do not know what that means
Ever hear of the fable "The boy who cried wolf"?
He cried Wolf and it turned out to be a fox. He gets a pass.
Girl, you're saying you trust software that documents security vulnerabilities that don't apply to you less than one that doesn't document those vulnerabilities?
A CVE isn't a black mark on a projects reputation.
Because of the way you misused terms, I'm guessing you're not particularly familiar with cybersecurity. It's an ever more important field for sysadmins and devs. I recommend taking the time to learn more.
It's not worthy of a CVE and whether it applies to me is irrelevant. I didn't say a CVE is a black mark. Frivolous reporting of CVEs damages trust in the usefulness of the system in identifying critical vulnerabilities. This is a known issue related to resumé padding by newcomers to the cybersecurity industry.
"Frivolous" "Frivolous" "Frivolous"
Is it because it's a DOS? No. That's valid.
Feature off by default? No, that still warrants CVE.
Feature labeled Beta or Experimental? Nope, still warranted.
You must be one of those newcomers big mad F5 now has control of the record and you can't pad your cv.
Uh, no. But thanks for guessing. It's frivolous because it violates several principles of responsible disclosure. Yes, the scope of impact is relevant; the availability of methods of remediation is relevant; and the development/patch lifecycle is relevant. The feature being off-by-default and labeled experimental are indirect references to the scope of impact and availability of remediation, and the latter is an indirect reference to the state of development lifecycle. Per the developer(s)' words, this is a bug that had limited risk and was scheduled to be fixed as part of the normal development schedule. Escalating every such bug, of which the vast majority go without a CVE, would quickly drown out notices that people actually care about. A CVE is not a bug report.
People who say this should be elevated to CVE haven't dealt with noise vs signal much.
Is it a risk, sure, but as you said it was already "experimental". Experimental shit means "don't do this in prod, but only in a proper managed lab".
That key word: experimental.
"Uh, no. The CVE is valid, but it's not about that." You say, scrambling. "The dev cycle! It was already scheduled for release, so it's not necessary to disclose. If everyone disclosed security bugs, we'd have too much information and we wouldn't be able to filter for the notices we care about." You retort, not realizing that you had already conceded that this wasn't about the fact you didn't care about the CVE, and instead arguing that less information is better rather than building tools to cope with the number of CVEs that are increasing regardless of their relevance to you personally.
I didn't say the CVE was valid. I explained why it was a mistake. I didn't say "disclosing security bugs" is, in general, a bad thing, I said raising undue alarm about a specific class of bugs is bad. It's not a matter of "less or more information," because as I said, a CVE is not a bug report. It is not simply "acknowledgment of information." If you think my argument has no merit and there is no reason why "more information" could be worse, you're free to talk to someone who gives a shit.
lol and you said you weren't big mad.
It’s not a matter of “less or more information[...]”
Escalating every such bug [...] would quickly drown out notices that people actually care about.
If your argument is that a specific class of security bugs aren't worth CVEs, then make that argument. Instead, you're saying the CVE isn't valid and making an argument about the risk assessment and development lifecycle (as if those aren't part of a CVE) and not the class of security bug.
I have, this entire time, said it's a valid CVE that you don't care about and that you shouldn't be working as a cybersecurity professional. You have conceded the first point and continued to demonstrate the later.
This conflict is positive. Many other reverse proxy software wouldn't be as "transparent" and the safety would then be false pretend.
They should have called IT mginx..
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!