A fuzzy issue of responsible disclosure [LWN.net]

A fuzzy issue of responsible disclosure

Posted Aug 19, 2022 10:58 UTC (Fri) by fratti (subscriber, #105722)
In reply to: A fuzzy issue of responsible disclosure by mcatanzaro
Parent article: A fuzzy issue of responsible disclosure

I completely agree, and don't even understand where filesystem developers are getting this idea from that mounting a filesystem should be an inherently dangerous activity. Imagine if someone told you opening JPEG files in an image viewer resulting in arbitrary code execution was just a fact of life. Hell, it's not like filesystems are the only pieces of code being fed with untrusted binary data that is complex to parse, the entirety of FFmpeg is fuzzed constantly and society is better off for it.

to post comments

A fuzzy issue of responsible disclosure

Posted Aug 19, 2022 13:53 UTC (Fri) by mathstuf (subscriber, #69389) [Link] (1 responses)

> the entirety of FFmpeg is fuzzed constantly and society is better off for it.

The part of society that gets updates to their FFmpeg are better off at least. (Yes, the solution is to shame the non-updater vendors.)

A fuzzy issue of responsible disclosure

Posted Aug 19, 2022 15:49 UTC (Fri) by flussence (guest, #85566) [Link]

>Yes, the solution is to shame the non-updater vendors.

Everyone who had a hand in the libav mutiny is culpable for half a decade of lost security here, though they'll never be held to account for it.