XMPP Council - 2022-03-14

larma has joined 00:20:28
pprrks has joined 00:43:16
neox has left 00:46:36
vaulor has left 00:53:39
pprrks has left 01:10:44
pprrks has joined 01:38:55
debacle has left 01:45:23
pprrks has left 01:46:28
larma has left 01:59:16
larma has joined 02:00:05
Kev has left 02:27:42
Kev has joined 02:27:54
marc0s has left 02:48:35
marc0s has joined 02:49:34
marc0s has left 03:21:13
marc0s has joined 03:21:15
Ingolf has left 03:45:25
Ingolf has joined 03:45:35
Zash has left 04:00:04
larma has left 04:05:32
larma has joined 04:06:36
Zash has joined 04:10:42
menel has joined 04:41:19
vaulor has joined 05:08:08
msavoritias has joined 05:20:50
Tobias has joined 05:39:35
pprrks has joined 06:02:29
me9 has joined 06:04:57
pprrks has left 06:23:45
me9 has left 06:33:03
pprrks has joined 06:41:57
neox has joined 06:53:44
pprrks has left 06:58:34
pprrks has joined 07:03:30
moparisthebest has left 07:55:01
pep. has joined 08:12:50
debacle has joined 08:32:51
pprrks has left 08:40:29
pprrks has joined 08:40:45
marc0s has left 08:58:28
marc0s has joined 08:58:30
pprrks has left 09:19:08
pprrks has joined 09:19:21
pprrks has left 09:24:31
pprrks has joined 09:24:41
pprrks has left 09:51:34
pprrks has joined 09:51:47
marc0s has left 09:53:30
marc0s has joined 09:53:31
marc0s has left 09:54:11
marc0s has joined 09:54:12
pprrks has left 09:57:01
pprrks has joined 09:57:13
marc0s has left 09:58:04
marc0s has joined 09:58:05
pprrks has left 10:03:02
pprrks has joined 10:03:13
iink has left 10:06:52
iink has joined 10:06:53
marc0s has left 10:29:03
marc0s has joined 10:29:04
pprrks has left 10:41:41
pprrks has joined 10:41:52
Wojtek has joined 10:50:44
Wojtek has left 11:22:06
Wojtek has joined 11:25:01
marc0s has left 11:37:09
marc0s has joined 11:37:11
pprrks has left 12:15:24
pprrks has joined 12:15:44
moparisthebest has joined 12:35:23
pprrks has left 12:42:46
pprrks has joined 12:42:58
marc0s has left 12:58:07
marc0s has joined 12:58:08
pprrks has left 12:59:03
pprrks has joined 12:59:15
marc0s has left 12:59:46
marc0s has joined 12:59:47
pprrks has left 13:10:07
pprrks has joined 13:10:18
me9 has joined 13:12:53
Wojtek has left 13:23:09
Wojtek has joined 13:23:33
pprrks has left 13:26:04
pprrks has joined 13:26:16
menel has left 13:29:34
pprrks has left 13:31:40
pprrks has joined 13:32:08
marc0s has left 13:39:20
marc0s has joined 13:39:21
Wojtek has left 13:39:29
Wojtek has joined 13:39:49
pprrks has left 14:09:32
pprrks has joined 14:09:44
pprrks has left 14:20:17
pprrks has joined 14:21:55
iink has left 14:23:00
iink has joined 14:23:44
iink has left 14:27:10
iink has joined 14:27:16
iink has left 14:29:20
iink has joined 14:31:12
iink has left 14:33:46
pprrks has left 14:39:20
pprrks has joined 14:39:32
pprrks has left 14:44:41
pprrks has joined 14:44:52
marc0s has left 14:57:23
marc0s has joined 14:57:24
pprrks has left 15:12:34
pprrks has joined 15:12:46
iink has joined 15:15:22
iink has left 15:17:09
iink has joined 15:18:26
moparisthebest has left 15:21:20
iink has left 15:25:11
iink has joined 15:26:06
iink has left 15:27:35
iink has joined 15:27:58
pprrks has left 15:28:35
pprrks has joined 15:28:46
iink has left 15:28:49
iink has joined 15:29:03
iink has left 15:29:39
iink has joined 15:30:09
moparisthebest has joined 15:30:30
iink has left 15:31:15
iink has joined 15:31:32
iink has left 15:32:06
iink has joined 15:32:42
iink has left 15:34:14
iink has joined 15:34:28
iink has left 15:35:57
iink has joined 15:36:25
iink has left 15:37:03
iink has joined 15:37:14
iink has left 15:40:31
pprrks has left 15:52:15
menel has joined 15:57:27
marc0s has left 16:00:03
marc0s has joined 16:00:05
marc0s has left 16:05:15
marc0s has joined 16:05:16
marc0s has left 16:06:02
marc0s has joined 16:06:03
me9 has left 16:07:54
marc0s has left 16:39:07
marc0s has joined 16:39:08
iink has joined 17:02:12
iink has left 17:02:42
Tobias has left 17:08:10
marc0s has left 17:36:47
marc0s has joined 17:36:49
marc0s has left 17:40:32
marc0s has joined 17:40:33
marc0s has left 17:43:43
marc0s has joined 17:43:44
marc0s has left 17:57:53
marc0s has joined 17:57:54
marc0s has left 18:03:49
marc0s has joined 18:03:50
moparisthebest 18:25:57
how long do CVE's stay hidden? do the CVE folk alert the maintainers or ?
moparisthebest 18:26:44
gajim has pushed a fix to their library but all gajims and pidgins from package managers in the wild remain vulnerable to trivial MITM
daniel 18:29:42
No. The CVE is just a number. You need to write that down (on a private url) and notify the maintainers
daniel 18:29:57
Send them the CVE and the problem description
moparisthebest 18:40:48
daniel: what do they need to do with it...
moparisthebest 18:40:56
(they don't know either)
daniel 18:44:56
Assuming it's fixed upstream what a package maintainer needs is the CVE (even if there is no actual content behind that), a description of the problem (the for now private url that later will become public), and a link to the upstream commit that fixes the issue. That allow the maintainer to put the fix into security updates. (some distributions have the policy to only allow security fixes and will cherry pick the fix)
Wojtek has left 18:45:13
daniel 18:45:56
If there is no upstream fix then I'm not sure what the 'correct' procedure is. You either wait until you can perform the steps above are just publish I guess
daniel 18:46:34
So to answer the question on 'when does a CVE becomes public' - that's for you to decide
vanitasvitae_ has left 19:39:55
vanitasvitae_ has joined 19:42:05
me9 has joined 20:41:39
mathieui has left 21:05:52
me9 has left 21:39:48
msavoritias has left 22:00:38
paul has left 22:19:03
pprrks has joined 22:28:59
menel has left 22:30:23
menel has joined 22:30:38
paul has joined 22:32:26
pprrks has left 22:34:38
moparisthebest has left 22:37:32
moparisthebest has joined 22:39:39
moparisthebest has left 22:39:56
moparisthebest has joined 22:41:13
moparisthebest has left 22:43:50
SouL has left 23:00:06
moparisthebest has joined 23:25:08
pep. has left 23:48:30
moparisthebest has left 23:56:29
moparisthebest has joined 23:59:15
Kev has left 23:59:57