5 ms·

if it's not compiled in by default, then you aren't shipping the code! Somebody is downloading it and compiling it themselves!

kelnos 3y ago
If the feature is in the code that's downloaded, regardless of whether or not the build process enables it by default, the code is definitely being shipped.
- ramses0 3y ago
  BRB, filing CVE's against literally any project with example code in their documentation...
  - spicykraken 3y ago
    I've actually seen CVEs like that before, I agree that's bonkers but I have seen it...
    - numbsafari 3y ago
      Given how frequently people copy and paste example code… why is that surprising? Folks need to be informed. CVEs are a channel for that.
      - mholt 3y ago
        Pssst: People who copy+paste example code aren't checking CVEs
  - MZMegaZone 3y ago
    That's actually supported by the CVE program rules. Have at it if you find examples with security vulns.
- anon-sre-srm 3y ago
  Yes. It's no different from any optional feature. Actual beta features should only be shipped in beta software .
- deleted 3y ago
  [deleted]
anon-sre-srm 3y ago
Incorrect. Features available to users still require a minimum, standard level of support. This is like the deceptive misnomer of staging and test environments provided to internal users used no differently than production in all but name.
- GoblinSlayer 3y ago
  Nobody does it like that though, what vendor declares unsupported is unsupported.
Twirrim 3y ago
You and I have very different notions of "shipped". It's open source code, it's being made publicly available. That's shipped, as I see it.
- aaronbwebber 3y ago
  This is an insane standard and attempting to adhere to it would mean that the CVE database, which is already mostly full of useless, irrelevant garbage, is now just the bug tracker for _every single open source project in the world_.
  - TedDoesntTalk 3y ago
    This. CVE has become garbage because "security researchers" are incentivized to file anything and everything so they can put it on their resume.
  - xcrunner529 3y ago
    Why is it insane? The CVE goal was to track vulnerabilities that customers could be exposed to. It is used…in public, released versions. Why wouldn’t it be tracked?
    - whoknowsidont 3y ago
      Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.
      - Twirrim 3y ago
        It's in the published source code, as a usable feature, just flagged as experimental and not compiled by default. It's not like this is some random development branch. It's there, to be used en route to being stable. People will have downloaded a release tagged version of the source code, compiled that feature in and used it. By what definition is that not shipped? > I am actually completely shocked this needs to be explained. Legitimate insanity. Right back at you.
mort96 3y ago
That .. is the definition of shipping the code, the code is being shipped to the people downloading and compiling it for themselves

kelnos 3y ago

If the feature is in the code that's downloaded, regardless of whether or not the build process enables it by default, the code is definitely being shipped.

ramses0 3y ago
BRB, filing CVE's against literally any project with example code in their documentation...
- spicykraken 3y ago
  I've actually seen CVEs like that before, I agree that's bonkers but I have seen it...
  - numbsafari 3y ago
    Given how frequently people copy and paste example code… why is that surprising? Folks need to be informed. CVEs are a channel for that.
    - mholt 3y ago
      Pssst: People who copy+paste example code aren't checking CVEs
- MZMegaZone 3y ago
  That's actually supported by the CVE program rules. Have at it if you find examples with security vulns.
anon-sre-srm 3y ago
Yes. It's no different from any optional feature. Actual beta features should only be shipped in beta software .
deleted 3y ago
[deleted]

anon-sre-srm 3y ago

Incorrect. Features available to users still require a minimum, standard level of support. This is like the deceptive misnomer of staging and test environments provided to internal users used no differently than production in all but name.

GoblinSlayer 3y ago
Nobody does it like that though, what vendor declares unsupported is unsupported.

Twirrim 3y ago

You and I have very different notions of "shipped". It's open source code, it's being made publicly available. That's shipped, as I see it.

aaronbwebber 3y ago
This is an insane standard and attempting to adhere to it would mean that the CVE database, which is already mostly full of useless, irrelevant garbage, is now just the bug tracker for _every single open source project in the world_.
- TedDoesntTalk 3y ago
  This. CVE has become garbage because "security researchers" are incentivized to file anything and everything so they can put it on their resume.
- xcrunner529 3y ago
  Why is it insane? The CVE goal was to track vulnerabilities that customers could be exposed to. It is used…in public, released versions. Why wouldn’t it be tracked?
  - whoknowsidont 3y ago
    Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.
    - Twirrim 3y ago
      It's in the published source code, as a usable feature, just flagged as experimental and not compiled by default. It's not like this is some random development branch. It's there, to be used en route to being stable. People will have downloaded a release tagged version of the source code, compiled that feature in and used it. By what definition is that not shipped? > I am actually completely shocked this needs to be explained. Legitimate insanity. Right back at you.

mort96 3y ago

That .. is the definition of shipping the code, the code is being shipped to the people downloading and compiling it for themselves