[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAG_fn=UJptH_tAKj+yCER-eWPRxF0R-E2N5TUFoYpBb2Yabg3g@mail.gmail.com>
Date: Mon, 17 Jun 2019 13:09:27 +0200
From: Alexander Potapenko <glider@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
On Mon, Jun 17, 2019 at 12:16 PM Robert Watson <robertcwatson1@...il.com> wrote:
>
> So Mr Gayner, which of these bugs have you fixed?
I think the NEWS page of GraphicsMagick
(http://www.graphicsmagick.org/NEWS.html) speaks for itself: the
developers recognize contributions of Alex and do not blame him for
not fixing all the bugs he found in the project.
Setting up continuous fuzzing for an OSS project is an unhairy job,
too. There doesn't seem to be a continuous flow of people doing that,
despite fixing a bug with a clear reproducer and a readable error
message is a lot easier than chasing the same bug in the wild.
> On Sat, Jun 15, 2019, 11:50 Alex Gaynor <alex.gaynor@...il.com> wrote:
>
> >
> > Today I'd like to highlight what I see as a tremendous issue: very few of
> > these security bugs ever has a CVE issued for it. This is probably due to a
> > few factors, a) the relative difficulty of obtaining a CVE, b) the lack of
> > a human reporter who is interested in obtaining one for "credit" purposes,
> > c) the sheer number of bugs that we're talking about.
> >
>
> >
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
