News for hackers. Stuff that matters.

A comment on Operation Rosehub – patching thousands of open-source projects.

Re:Operation Rosehub – patching thousands of open-source pro... by markcerqueira on Wednesday March 01, 2017 @07:09PM (#13770068)
"Patches were sent to many projects, avoiding threats to public security for years to come."

Are these pull requests that the project would still need to approve/merge or were they just pushed in?

[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by edutechnion on Wednesday March 01, 2017 @07:15PM (#13770116)
They were PRs that required approval and merge from the Github project maintainers. Here is a search to see some of their work:

https://github.com/search?q=%22Upgrade+Apache+Commons+Collec...

[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by fudged71 on Wednesday March 01, 2017 @08:44PM (#13770669)
It's actually incredibly interesting to read how the developers individually responded to each of these PRs.

It would have been great to see a count of how many PRs have been accepted.

[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by cpeterso on Wednesday March 01, 2017 @09:38PM (#13770956)
edutechnion's link says 1108 open PRs and 999 closed.

Interesting that 2100 of the PRs are "Upgrade Apache Commons Collections to v3.2.2" and just 7 were "Upgrade Apache Commons Collections to v4.1".

[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by therealdrag0 on Thursday March 02, 2017 @02:02PM (#13777105)
Probably v3.2.2 was lower hanging fruit for most projects. Instead of having to make code changes.
[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by hinkley on Wednesday March 01, 2017 @07:43PM (#13770287)
For me, if a project had a bunch of open PRs for security issues, it would discourage me from using it for new work. It would also help break a tie in my head between keeping an old library and replacing it with something that has legs.

So even if they don't get merged, they still serve a purpose, even if it's just for a few people who behave like I do.

[ Parent | on HN ]
Re:Operation Rosehub – patching thousands of open-source pro... by unityByFreedom on Wednesday March 01, 2017 @07:15PM (#13770120)
I'm sure they're requests.. They'd need to be deployed to production too.

Still pretty awesome.

[ Parent | on HN ]