9

If I know about a critical bug in recently (some hours/days ago) released software, is it appropriate to post a warning in ServerFault (with details what was affected in my case etc.)?

P.S. Software authors already know about the bug and avoiding the update might save time for some/many ServerFault users.

2
  • Best etiquette is to disclose the bug to the author/vendor, and give them time to fix it before releasing it publicly. Otherwise, everyone who doesn't read your post might be vulnerable to anyone who does.
    – jpaugh
    Commented Jul 8, 2016 at 0:20
  • Better still would be, if the update is seriously buggy in a way that risks breaking things for some nontrivial number of people (which is probably why the vendor is working on a fix for the update in the first place), for the vendor to simply pull the update while working on a fix.
    – user
    Commented Jul 12, 2016 at 13:04

3 Answers 3

Reset to default
19

SF is not for announcements. There are plenty of other venues for those.

However, if it can be phrased as a well-reasoned question, something that would otherwise be on topic here, I'm fine with you posting it, along with an answer.

If it cannot be posted as a question/answer pair, then take a pass this time.

3
  • I believe this could be formulated as question/answer. And serious software bugs will create many on-topic questions here (as the users will post questions about situations caused by the bug). In this case software authors have withdrawn the affected release (so there is much lesser need for sharing this info).
    – DavisNT
    Commented Jul 3, 2016 at 18:35
  • I haven't used the chat rooms much and don't know how often they are used, but maybe that could be a fitting place to announce defects and vulnerabilities.
    – Sam Erde
    Commented Jul 5, 2016 at 13:09
  • +1 for not allowing announcements as stand-alone items. There are indeed other and better channels for that. Having said that quite a few security incidents (get a cute name, their own vanity domains and associated websites and) result in relevant on-topic Q&A's anyhow as people struggle with work-arounds and mitigating measures I.e. BEAST , heartbleed , poodle etc.
    – HBruijn Mod
    Commented Jul 5, 2016 at 21:08
4

An announcement by itself that $random_crappy_piece_of_software proved to be even more crap than previously expected is not really a useful addition. Neither are announcements on SF that said piece of crap is supposedly now patched and slightly less so...

Much more relevant are tricks and experiences that deviate from or expand the vendor recommendations, (remote) detection, work-arounds and mitigating measures you can take when upgrading/patching is not immediately possible. This heartbleed Q&A is a good example of how such a Q&A can turn out.

1
  • 1
    Note that OP is talking about $random_crappy_piece_of_software having been updated in a way such that it now has a bug making it $random_crappier_piece_of_software, and the user or administrator can keep it being just "crappy" instead of "crappier" by not installing that particular update.
    – user
    Commented Jul 12, 2016 at 13:03
2

Legally speaking you can get in trouble if its a security bug you disclose, please back yourselft in such case. (like warning the vendor dev that you will disclose in example)

THE list for security bug disclosure; http://seclists.org/fulldisclosure/

1
  • 1
    In some jurisdictions it makes a difference what the intent of the publication is. If the intent is to aid administrators protecting themselves, then publication would be legal. But if the intent is to aid attackers in breaking in, then the publication would be illegal. And that would be the case even if the actual published information about the vulnerability might be the same in both cases.
    – kasperd
    Commented Jul 6, 2016 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .