Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
What a dick that guy is.
I don't really see what is so bad here... There was disclosure of type, but no reference to the exact code. This gives the maintainer a chance to reach out for specifics before bad actors can make a pseudo-zero day.
Is it the language you object to?
The entire attitude is shit. Could just contact the developers as outlined, instead of being a prude about it for some clout.
I understand what you're saying, but Forgejo has an outdated and made-up-from-thin-air policy. From their security.md:
And it just goes on, like someone from 2003 wrote that policy.
Now, I'm going to agree with you that it's a bit of a dick move to do the carrot dangle thing, but some vendors/devs just don't respond without the pressure. And forgejo has been forced by github supporters to implement a security policy after trying to ignore it.
It seems that the author has some ongoing interactions with forgejo, and it would be great if these were disclosed in the article, but forgejo seems to need a kick in the pants, especially over an RCE, the forbidden sev 10 of vulns.
If you replaced Forgejo with GitHub then I would understand, but Forgejo isn't a massive organization with hundreds of hired employees, it's run by people in their spare time with the option of donations.
Anyone can help contribute, instead of doing that, this guy decided to try and get some clout by being an asshole because he is butthurt about some other interaction. If this guy went about it the proper way and then still got no answer or fix after months, then I would understand more, but he didn't.
PGP/GPG has existed for decades as a way to encrypt email.
Edit: I hate to remove comments and it may get me banned but due to the hate speech I'm receiving regarding things unrelated to software while trying to sympathize with a frustrated security researcher who got caught up in unnecessary bureaucracy when taken en masse, I'm going to remove these comments for now. This is why we volunteer FOSS engineers have to stay clear of popular projects I guess.
Forgejo has a responsible disclosure policy, but this person seems like they just don't want to deal with that and instead opted for the nuclear option immediately.
Did you read the policy and how complex it is? Did you look at the fixes they submitted and how simplistic they were that were rejected for not following a super complex policy meant for major issues in proprietary software? If an expert submits a fix with little to no risk and lots of potential for harm, why not have a simple process or just accept the fix? I wouldn't want to follow that complex process and wait for embargos to pass before being allowed to suggest the fix for each of those issues.
Erm, did you read them? The policies aren't complex at all, just submit the issue (and proposed fix if there is one) through a secure channel, that they're happy to help set up. If you want to disclose the vulnerability, just wait until the embargo passes so there's time to fix and have users update. There's not really anything else you need to do here. This is pretty standard stuff that this person just seemed too lazy to participate in.
Of the three fixes submitted, only a single one was closed since it didn't seem very major and would be a breaking change (which shouldn't be made without prior discussion). The other two are still open, and a maintainer is helping to add tests for the fixes (since the author didn't add them). The only comment that was somewhat negative was that security fixes should preferably follow the established guidelines. That's all.
Yea. But did you read the security.md?
Use an encrypted email to security@forgejo.com. If you can't, tell them and they will set one up.
Seems very assholeish to not at least do that.
They explained that due to the systemic nature of the issues, many of which are across all forks of gitea, and the complex nature of the policy meaning disclosing each one individually and following the separate policies depending on the specifics of each issue, would require a very significant amount of time. Probably a day job worth for a while.
So, they could either drop it and give up, spend all of their free time for the foreseeable future properly disclosing each defect, or use the method they chose to get some level of attention on it without exposing details or breaking the security policy, but still letting both developers and users that there are issues.
Alternatively, they could have sent the security team an email with the 'carrot' and saying "There seems to be fundamental, systemic, security issues in Forgejo; here's some proof. There's too much for me to raise individual reports, what are we going to do about it?"
I think there's pros and cons to everything. That way would have been less of a dickhead move towards the Forgejo developers. But a big letdown to admins as they don't know what's up with the software they're running on their servers. The way the author chose gives some new intelligence to admins, and they can now act on it, since it's public knowledge. But it's annoying to the devs.
I guess I as a Forgejo user am kinda greatful they did it this way. Now I got to learn the story and can allocate 2h on the weekend to see if my personal Forgejo container is isolated enough and whether the backups still work.
(But that's just my opinion after reading one side of the story. Maybe there's more to the story and they're being a dick nonetheless...)
Edit: And regarding just dropping the security team an informal mail... I don't know if that's clever. You'd normally either follow some security policy, or don't engage. Sending them other kinds of mails which violate their policy (an internal carrot) might not be the best choice.
I believe they were already frustrated by the responses to the fixes they did submit.
I get the frustration. It is how many big companies avoid responsibility, but that's usually to avoid cost on actually fixing stuff. In a FOSS project, what's the point of rejecting a simple fix because some complex process meant for complex issues in proprietary software that the security researcher can't suggest specific fixes for wasn't followed. Why fill out a bunch of "paperwork" and initiate a long embargo period before a fix is considered when the fix is already submitted and is simple enough and low risk and impact enough to not require more that a cursory review. It's like asking a road engineer who sees a small pothole that only damages a few cars a year and offers to fill it because they are often affected by it to file a superior court case in order to report it, much less fix it.
So, it's a matter of, give up because it's too much of a burden to report, or announce in the most ethical way possible to incentivize fixes actually happening.
Edit: based on replies I guess my analogy was better in my head than on paper without explaining. Rather than try a new analogy let me explain a bit.
I wasn't saying the city should let the engineer fix it. I'm saying they shouldn't have let it get that far and should have followed normal pothole patching processes that probably would have been resolved weeks before despite the potholes having caused damage/bug being "security" related rather than feature related. But despite filing detailed bug reports and patches they were told they had to follow a complex policy of notifications and do it separately for each defect of which there were likely to be many, individually, that include triggering an embargo that would not allow them to write or submit those patches for 90 days at which point this engineer would likely have moved on to other issues and forgotten all of the details of how to fix the issues. Heck I often forget and have to start over after a few days much less months.
I don’t think you read the article.
Did you miss this part
Sounds like him being lazy.
Your comment said Forgejo has a disclosure process. The article says the author went with a carrot disclosure after reading the disclosure process and making a value judgement. Because your comment only mentioned Forgejo having a disclosure process, not an evaluation of the author’s evaluation of the disclosure process, it made you appear as if you had not read the article.
In your response to me calling that out, you offer an analysis. The author is lazy for using carrot disclosure over the defined disclosure process. That’s a valid take. I’m not going to disagree with that.
this defense edit does not make sense. no, volunteer foss engineers don't need to stay clear of popular projects. if the allegations in the replies are true, I'm genuinely sorry for that, but that's not a risk of being a foss developer, that is a risk of discussing on the internet.
if people are harassing you, you should report them to the admins.
People were harassing me for trying to supporting the person in question. However, they were using information from my other posts to use hate speech to do it. Their arguments against my points had no real content beyond "I'm right and I'm mad you keep making points that question that rightness." Removing those hopefully will leave others with similar belligerent opinions from digging into my post history to harass and try to bring harm to me because of my gender in retaliation for debating their rightness.
Can you please point out the hate speech you received? I can't find any in the comments here, just people having different opinions.
They were DMed to me, and was disagreeing with me on this subject and then using anti-trans slurs. I got a bunch all in a short period, so I'm guessing a single actor or anti-trans group using multiple accounts. But I decided it wasn't worth my emotional energy to keep the comments up and have others do the same. Sucks that some people can't have discussions without finding something they hate about you and using that to make themselves feel superior when they dont have any real argument to make other than "you're wrong".
Honestly, I abandoned my lemmy.world account last year when Serinus changed the moderation policy that the "narrative" that trans people are not real or are mentally ill or whatever to not be considered hate speech and thus not to be removed automatically, following the similar change at Facebook. I guess I should continue to steer clear of the server since it seems it has given bigots a feeling that they aren't the bad guy as I argued it would just like it did with Facebook, X, and the others. Sucks that we can't live in peace. And that's all I'll say on the matter as I dont have the energy to convince anyone that trans people do exist, it's widely accepted medical science from all unbiased medical organizations and it is definitely as much hate speech so say a trans person isn't their gender as it is to say a black person is a non-human primate.
wow, that's wild. they do have quite a few highly questionable decisions, to put it gently. maybe we should treat them like we do .ml, and encourage people to move to other instances, while generally not participating in their communities