15 years later: remote code execution in qmail

Re:15 years later: remote code execution in qmail by kelnos on Wednesday May 20, 2020 @09:51PM (#23254091)

The funny thing about that is I find his code to be very difficult to read (even just the snippets in the linked CVE illustrate this).

And his attitude is just bonkers to me. "I'm not going to fix this exploitable security issue because I assume that people will configure their environment in a particular way." What? That's... flat-out irresponsible.

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by dependenttypes on Thursday May 21, 2020 @01:14AM (#23255035)

He does not have any responsibility against anyone. He released his software in public domain with the source included for free.

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by loup-vaillant on Thursday May 21, 2020 @05:32AM (#23256448)

When you release software for the world to use, tell everyone it's secure, even put up a bug bounty… that kinda means you are taking responsibility.

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by morelisp on Thursday May 21, 2020 @05:23AM (#23256395)

Putting aside question of if can have responsibility for freely-released work (especially when one has made a big deal of money offered in exchange for this kind of finding), at the time this bug was discovered the software was emphatically not in the public domain and difficult to distribute modified versions of despite available source.

[ Parent | on HN ]