• 1 Post
  • 8 Comments
Joined 3 years ago
cake
Cake day: January 23rd, 2022

help-circle
  • Pedophilia has a longstanding history in the music industry. Priscilla was 14 when she met Elvis, Lori Mattix admitted to sleeping with rockstars as early as 14, Sable Starr admitted to doing so when she was 12, both were part of an infamous group dubbed the “baby groupies,” it was so prevalent that it disgusted Danny Elfman into writing “Little Girls” about the record execs he had witnessed participating in pedophilia. There’s at least a dozen examples I could pull from recent times just off the top of my head, but they’re all more niche and less likely to catch people’s eyes.









  • Context:

    TLDR: The devs don’t like bugs in released software being assigned CVEs, which requires a special security update instead of a standard bugfix included in the regular update cycle.

    :The most recent “security advisory” was released despite the fact
    : that the particular bug in the experimental HTTP/3 code is
    : expected to be fixed as a normal bug as per the existing security
    : policy, and all the developers, including me, agree on this.
    :
    : And, while the particular action isn’t exactly very bad, the
    : approach in general is quite problematic.

    There was no public discussion. The only discussion I’m aware of
    happened on the security-alert@ list, and the consensus was that
    the bug should be fixed as a normal bug. Still, I was reached
    several days ago with the information that some unnamed management
    requested an advisory and security release anyway, regardless of
    the policy and developers position.

    And nginx’s announcement about these CVEs

    Historically, we did not issue CVEs for experimental features and instead would patch the relevant code and release it as part of a standard release. For commercial customers of NGINX Plus, the previous two versions would be patched and released to customers. We felt that not issuing a similar patch for NGINX Open Source would be a disservice to our community. Additionally, fixing the issue in the open source branch would have exposed users to the vulnerability without providing a binary.

    Our decision to release a patch for both NGINX Open Source and NGINX Plus is rooted in doing what is right – to deliver highly secure software for our customers and community. Furthermore, we’re making a commitment to document and release a clear policy for how future security vulnerabilities will be addressed in a timely and transparent manner.