News for hackers. Stuff that matters.

A comment on Golang SSH Security. Parent comment

Re:Golang SSH Security by tptacek on Saturday April 15, 2017 @04:09PM (#14122579)
What does a CVE number have to do with whether the target is experimental? A bug is a bug.
[ Parent | on HN ]
Re:Golang SSH Security by baby on Saturday April 15, 2017 @04:16PM (#14122602)
I'd expect an experimental library to possibly be filled with bugs and constantly evolve (in a breaking way) its API while having a "USE AT YOUR OWN RISK" message. Although that might not be how the namespace golang.org/x/ is defined.

Looking here: https://golang.org/doc/go1compat

> may be developed under looser compatibility requirements

looks like that might explain why it's a CVE. Also another good answer from Zaki: https://twitter.com/zmanian/status/853342150272008192

[ Parent | on HN ]
Re:Golang SSH Security by ymse on Saturday April 15, 2017 @04:43PM (#14122753)
CVEs can be thought of more as a public security advisory. Many vendors and distributions follow the CVE list. If there was no CVE, this issue might have gone unrecognised in your package manager or paid software product for a long time.
[ Parent | on HN ]
Re:Golang SSH Security by baby on Sunday April 16, 2017 @04:32AM (#14124964)
> your package manager or paid software product

I'd hope these don't use experimental libraries. Although as others pointed out to me, this is not an experimental library :) (which was the answer I was looking for)

[ Parent | on HN ]