![shantanu-vsbhosale commented on May 26 [context: a library we ship with mitmproxy has a vulnerability in parts not used by mitmproxy, so it does not not affect our users] @Prinzhorn @mhils Just curious why are we not releasing the fix even though CVE-2023-0286 is a High severity vulnerability ? Developers who are already using library cryptography > 39.0.1 won't be able to use mitmproxy. Other libraries have already released the fix. For example, https://pypi.org/project/pyOpenSSL/23.1.0/ Prinzhorn commented on May 26 # 5966 (comment) I don't think either of the posted vulnerabilities affects mitmproxy users in a significant way, so I don't think we will ship a patch release just for that. :) FrugalGuy commented yesterday 28 @Prinzhorn Do you have a target date for the next release? Our customers in regulated industries (banking, federal, etc.) are prohibited by regulations from using s/w with known High and Critical severity vulnerabilities. I'm trying to formulate our case for waiting, but need some kind of target date. mhils commented yesterday 36 @FrugalGuy: If you are interested in timely patch releases to fix your company's compliance requirements, I'm happy to set up a support contract. Email is on my profile. :-) 18 3. mitmproxy locked as too heated and limited conversation to collaborators 10 hours ago Concerning response > Inbox x to github@hi.ls ▾ Mr. Hils, mhils commented Member @us.ibm.com> Jul 14, 2023, 11:56 PM (14 hours ago) hours ago Rather than inflame matters or pollute the github issue tracker with unnecessary verbiage, I'm hoping to better explain my request for a target date in hopes of getting a direct answer. I hope you won't find this follow-up to be offensive - that's certainly not my intention. Member I'm assuming your response to my request for the next mitmproxy target date was a joke rather than an official project response or, worse, a thinly veiled extortion attempt. In reviewing the project's official documentation, mhils commented 9 hours ago Reply to all I @FrugalGuy has just sent me genuine apology, which I truly appreciate. Please be nice and assume good intentions. Since this has been picked up by some news sites I'd like to provide some additional context here: I don't mind the release question at all, it's valid! But the context should ideally be along the lines of "we have an interest in this, how can we help make it happen" (contributions or $) and not "you are causing problems for our customers". I don't want the requestor to have a miserable time because of a badly-worded comment, I want large companies to have a healthy relationship with FOSS. Member Member](https://i.kym-cdn.com/photos/images/original/002/622/952/499.png "IBMer asks for a patch release date in the worst possible way")
-1
IBMer asks for a patch release date in the worst possible way
Uploaded by Lugamo Jul 15, 2023 at 10:29PM EDT
ibm ibmer mitmproxy maximilian hils
Origin Entry: GitHub
File type: png
Resolution: (915px x 1689px)
File size: 178 KB
![DrPizza/DupeHunter DrPizza LOG OUT refreshing.. master Peter Bright 9edf122de473d531aa485e8fb10044588b uncommitted changes SHOW revert commit roll back to this commit reduce indent, use auto E githubX history DupeHunter src DupeHunter.cpp Peter Bright reduce indent, use auto Apr 13 Apr 12 Apr 12 Apr 12 old new Peter Bright Off-by-one, I think 6,9 +6,9 00 6 6typedef std: :mapkunsigned int64, std: :vector std: :wstring> > size_map_t 7 Peter Bright Add license, readme 8 9 8bool permitted_name (const std::wstring& name, const std::vector<boost: :w for(std::vector<boost::wregex>::const iterator ipit(include_patter for(auto ipit(include_patterns.cbegin)), ipend(include_patterns.ce Peter Bright first commit 10 10 if(boost::regex_match(name, ipit)) { for(std::vector<boost: :wregex>::const_iterator epit for(auto epit(exclude_patterns.cbegin()), epend (exc if(boost::regex_match(name, *epit)) 12 13 12 13 return false 39,7 +39,7 unsignedint64 populate files (size_map_type& files, co 40 41 41 42 const std: :wstring search_path(basePath (basePath [basePath.size(. NIN32-FIND DATA found = {0}; HANDLE finder(: :FindFirstFilew(search_path.c str), &found)); ON_BLOCK_EXIT(]) :FindClose(finder) ON-BLOCK-EXIT([=] { : : FindClose (finder); }); 40 42+ 43 43 static const wchar_t* dot(L".").; static const wchar_t* dotdot(L".."); 45 45 88,7 +88,7 a std::vector<std::vector<std::wstringnway compare(un throw std::exception( "Buffer too small for this number of f 89 90 91 89 90 static const unsigned int64 sector size(4096):/I TODO get the r const unsigned int64 rounded file size round to next multiple (1 const unsignedint64 rounded file_size(round_to_next_multiple (fi. const bool aligned reads (static cast«unsigned int64) (names 91+ 92 92](https://i.kym-cdn.com/photos/images/list/000/963/914/90f.png "Github Repo Screenshot")
More:
![DrPizza/DupeHunter DrPizza LOG OUT refreshing.. master Peter Bright 9edf122de473d531aa485e8fb10044588b uncommitted changes SHOW revert commit roll back to this commit reduce indent, use auto E githubX history DupeHunter src DupeHunter.cpp Peter Bright reduce indent, use auto Apr 13 Apr 12 Apr 12 Apr 12 old new Peter Bright Off-by-one, I think 6,9 +6,9 00 6 6typedef std: :mapkunsigned int64, std: :vector std: :wstring> > size_map_t 7 Peter Bright Add license, readme 8 9 8bool permitted_name (const std::wstring& name, const std::vector<boost: :w for(std::vector<boost::wregex>::const iterator ipit(include_patter for(auto ipit(include_patterns.cbegin)), ipend(include_patterns.ce Peter Bright first commit 10 10 if(boost::regex_match(name, ipit)) { for(std::vector<boost: :wregex>::const_iterator epit for(auto epit(exclude_patterns.cbegin()), epend (exc if(boost::regex_match(name, *epit)) 12 13 12 13 return false 39,7 +39,7 unsignedint64 populate files (size_map_type& files, co 40 41 41 42 const std: :wstring search_path(basePath (basePath [basePath.size(. NIN32-FIND DATA found = {0}; HANDLE finder(: :FindFirstFilew(search_path.c str), &found)); ON_BLOCK_EXIT(]) :FindClose(finder) ON-BLOCK-EXIT([=] { : : FindClose (finder); }); 40 42+ 43 43 static const wchar_t* dot(L".").; static const wchar_t* dotdot(L".."); 45 45 88,7 +88,7 a std::vector<std::vector<std::wstringnway compare(un throw std::exception( "Buffer too small for this number of f 89 90 91 89 90 static const unsigned int64 sector size(4096):/I TODO get the r const unsigned int64 rounded file size round to next multiple (1 const unsignedint64 rounded file_size(round_to_next_multiple (fi. const bool aligned reads (static cast«unsigned int64) (names 91+ 92 92](https://i.kym-cdn.com/photos/images/newsfeed/000/963/914/90f.png "Github Repo Screenshot")
![2 Edit Post Jason Neylon's Bl X .Jasonneylon/dotfiles-GitHu ← → https://github.com/Jasonneylon/dotfiles/ Ruby on Rails Tutor Campfire: Rev HTML5 Presentation Bu FlashwavRecorder java-How does one web development-i D later D Readability Other Bookmarks E » iasonneylon Dashboard Inbox Account Settings Log Out github SOCIAL CODING Explore GitHub Gist Blog Help Search jasonneylon / dotfiles Admin Unwatch Forku Pull Request 1 4 1 eimim Source Commits Network Pull Requests (0) Fork Queue Issues (0) Wiki (0) Graphs Branch: master Switch Branches (1)Switch Tags (O) ranch List My dotfiles click here to add a homepage Downloads SSH HTTP Git Read-Only gitegithub.com:jasonneylon/dotfiles.git This URL has Read-Write access commit 3608b9709255477210f1 tree faa205ca9c53e6dØfe61 parent ec82447a9f47e4d7b4a1 Minor tweak to github function jasonneylon (author) 15 minutes ago dotfiles / name history age about an hour ago 2 days ago 2 days ago message My first bash function [jasonneylon] Moved stuff around [jasonneylon] Added base files Ljasonneylon bash/ env git-completion.sh](https://i.kym-cdn.com/photos/images/newsfeed/000/963/911/02d.png "Github Repo Screenshot")
-1
GitHub - IBMer asks for a patch release date in the worst possible way
| View Gallery Random Image | Next ► |
![shantanu-vsbhosale commented on May 26 [context: a library we ship with mitmproxy has a vulnerability in parts not used by mitmproxy, so it does not not affect our users] @Prinzhorn @mhils Just curious why are we not releasing the fix even though CVE-2023-0286 is a High severity vulnerability ? Developers who are already using library cryptography > 39.0.1 won't be able to use mitmproxy. Other libraries have already released the fix. For example, https://pypi.org/project/pyOpenSSL/23.1.0/ Prinzhorn commented on May 26 # 5966 (comment) I don't think either of the posted vulnerabilities affects mitmproxy users in a significant way, so I don't think we will ship a patch release just for that. :) FrugalGuy commented yesterday 28 @Prinzhorn Do you have a target date for the next release? Our customers in regulated industries (banking, federal, etc.) are prohibited by regulations from using s/w with known High and Critical severity vulnerabilities. I'm trying to formulate our case for waiting, but need some kind of target date. mhils commented yesterday 36 @FrugalGuy: If you are interested in timely patch releases to fix your company's compliance requirements, I'm happy to set up a support contract. Email is on my profile. :-) 18 3. mitmproxy locked as too heated and limited conversation to collaborators 10 hours ago Concerning response > Inbox x to github@hi.ls ▾ Mr. Hils, mhils commented Member @us.ibm.com> Jul 14, 2023, 11:56 PM (14 hours ago) hours ago Rather than inflame matters or pollute the github issue tracker with unnecessary verbiage, I'm hoping to better explain my request for a target date in hopes of getting a direct answer. I hope you won't find this follow-up to be offensive - that's certainly not my intention. Member I'm assuming your response to my request for the next mitmproxy target date was a joke rather than an official project response or, worse, a thinly veiled extortion attempt. In reviewing the project's official documentation, mhils commented 9 hours ago Reply to all I @FrugalGuy has just sent me genuine apology, which I truly appreciate. Please be nice and assume good intentions. Since this has been picked up by some news sites I'd like to provide some additional context here: I don't mind the release question at all, it's valid! But the context should ideally be along the lines of "we have an interest in this, how can we help make it happen" (contributions or $) and not "you are causing problems for our customers". I don't want the requestor to have a miserable time because of a badly-worded comment, I want large companies to have a healthy relationship with FOSS. Member Member](https://i.kym-cdn.com/photos/images/list/002/622/952/499.png "IBMer asks for a patch release date in the worst possible way")
Comments (0)
Add a Comment
Image Details
272 views (12 from today)
Uploaded Jul 15, 2023 at 10:29PM EDT
Origin Entry
Tags
About the Uploader
Lugamo
Archivist & Commentator & Collection Butler
There are no comments currently available.
Display Comments