Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Saturday, 20-Jun-2026 23:30:01 JST Rich Felker

   • Matt "msw" Wilson

   @ska @msw The problem wasn't the bug being fixed but a malicious security appliance breaking any use of the protocol feature the fixed bug was in, in order to "protect" outdated OpenSSL behind it.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 20-Jun-2026 23:39:44 JST Rich Felker

     in reply to

     • Matt "msw" Wilson

     @msw @ska If they were going to cut off a protocol feature like this, they needed to make it honor the protocol to fall back, if that's possible. Not break the protocol.

   • Embed this notice
     Matt "msw" Wilson (msw@mstdn.social)'s status on Saturday, 20-Jun-2026 23:39:45 JST Matt "msw" Wilson

     in reply to

     @dalias @ska I think that the vendor of the appliance has good intentions, but there are intended consequences.

     Unfortunately those unintended consequences can be long lasting, and encumber progress.

     For some run-of-the-mill bugs where the most likely worst case is a crash (which can be detected), I question if we need to go to the trouble of issuing a special "security bulletin", rather than just keeping a detailed changelog / commit message.