Stephen John Smoogen wrote:
On Feb 9, 2008 12:11 PM, Lubomir Kundrak <lkundrak@xxxxxxxxxx> wrote:
Hi,
On Fri, 2008-02-08 at 21:16 -0800, Bryan O'Sullivan wrote:
A bug in a piece of widely used PHP-based software was announced a few
days ago, and it's now being actively exploited by spammers:
http://wordpress.org/development/2008/02/wordpress-233/
Affected machines include my server, which is running F-8. Eep.
Pardon me -- my point of view is by using wordpress you voluntary agree
to get exploited, and no wordpress vulnerability is ever to be
considered as having priority higher than low.
...
Please note that responsible configuration in most cases implies no
WordPress. Don't get me wrong please -- look at its security track.
PS: Note we may be on during weekends too anyways -- as I am now.
Remember we fixed a security issue on Christmas Eve.
Thanks,
--
Lubomir Kundrak (Red Hat Security Response Team)
Wow I would say the same thing about the kernel. I mean look at its
track record.. over the last 6 months and many years there have been
tons of security updates for it. Are there any packages that don't hit
that litmus check (other than maybe DJB software)?
People use the tools that are useful for them. The job of a security
professional is to help them make better choices. In some cases that
is making the tool better, in other cases it is finding them a better
tool to work with. Commenting about how one feels a software choice
was poor when that person is dealing with a crisis, does not help the
person affected at all, and gives in this case Red Hat, Fedora, and
other security professionals a bad name.
Nevertheless any security professional has limited resources and time, and they
must choose to fix what can be fixed in some order given those resources... and
it is *absolutely reasonable* to consider a piece of software with a record of
having many poor coding practice caused security issues to be lower priority.
Nothing in Lubomir's email said he or anyone else in RH and Fedora security
teams do not intend to fix WP problems.
--
Andrew Farris <lordmorgul@xxxxxxxxx> www.lordmorgul.net
gpg 0xC99B1DF3 fingerprint CDEC 6FAD BA27 40DF 707E A2E0 F0F6 E622 C99B 1DF3
No one now has, and no one will ever again get, the big picture. - Daniel Geer
---- ----
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
