"A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it."

When your program doesn't handle a malformed input, and this leads to a buffer overflow, it's your fault. When this program is something as important as systemd, the problem is even worse.

Anything Internet-facing has to accept any kind of packet without crashing, or at least without failing in an exploitable way. That's the bare minimum you-must-be-this-tall entry requirement of security.

I believe it was a joke about how Lennart Poettering usually responds to bug reports.

You are correct. See, for example, his recent response to the issue where systemd starts processes belonging to users whose usernames begin with a digit with root privileges: https://github.com/systemd/systemd/issues/6237#issuecomment-...

My deepest apologies to HN for the overly-dry sense of humor.

Trolling on HN really is like shooting fish in a barrel, isn't it?