[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20261027164520.GJ23438@brightrain.aerifal.cx>
Date: Tue, 27 Oct 2026 12:45:20 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] regex: fix BRE backref OOB read on multibyte input
On Tue, Oct 27, 2026 at 12:33:46PM -0400, Rich Felker wrote:
> On Tue, Oct 27, 2026 at 05:20:58PM +0100, Szabolcs Nagy wrote:
> > * Szabolcs Nagy <nsz@...t70.net> [2026-10-27 17:04:04 +0100]:
> > > this passes my regex tests with no regressions
> > >
> > > pos_add_next is recomputed where necessary
> > > (could have been saved/restored but that's more change)
> > >
> > > the patch fixes 2 bugs, but they are related.
> >
> > sorry, forgot to add attribution to calif.io in the commit
> > i guess such a bug report can be expensive
>
> We do not do adverts for companies in commit messages.
I guess that was a little terse, and there's more I'd like to say on
this. I'm not faulting you here, but it's really weird to me that
there is suddenly this implicit assumption that a company doing
bug-hunting stuff should be credited for finding a bug now that
they're AI-industry-affiliated, when that's not how anything worked in
the past.
We have never credited proprietary static analysis or fuzzing tools
uses to find bugs in the past, and the reason I haven't is because I
do not want an immutable git log to be an advertising platform serving
the valuation of a business and encouraging the use of proprietary
tools.
We sometimes do credit individual people who reported a bug if they've
been involved in actually helping understand and fix it, especially if
it's important/security-relevant. But this kind of credit should
reflect a pro-social engagement with the community not just checking
what their slop-bot told them and leaving us to figure out whether the
report is even valid and how to write a test case to reproduce it.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
