Hacker News Reader

Comment by edoceo | Hacker News Reader

But does it affect Bao? Could test there since they are so closely related.

OpenBao maintainer here - The majority of these does affect us, more or less. Unfortunately it seems that we did not receive any prior outreach regarding these vulnerabilities before publication... make of that what you will. We've been hard at work the past days trying to get a security release out, which will likely land today.

Thanks for the great work and swift communication

I'm very disappointed to hear that the researchers did not disclose these findings to the OpenBao project before publishing them, so you now have to rush a release like this

Will you reach out to the researchers for an explanation after you've fixed the issues?

I can explain* researchers (and myself, though have nothing to do with it): We both learned about OpenBao today.

explanation ≠ excuse

Thank you for the explanation. It's obviously not great that this was missed, but finger-pointing now doesn't really help anyone, so I'll focus on what seems to me like the root issue

My impression is that there is an information gap about forked projects that lead to this issue

I'm on vacation right now, but when I'm back I'll try to setup a small site that lists forks of popular projects and maybe some information on when in time the project was forked

Hopefully something like that can make it more likely that these things are responsibly disclosed to all relevant projects

It sounds like these issues are from before the fork, in which case they will be

It also doesn't sound like the researchers made an effort to safely disclose these findings to the OpenBao project before publishing them, which I think would have been the right thing to do

Reply on news.ycombinator.com