Rendered at 09:43:35 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
collinfunk 5 hours ago [-]
As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled:
Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing).
The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch.
Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting.
The bug was reported on a public mailing list, which is sadly common nowadays
In defence of the reporter, your Readme only says "Send bug reports to bug-inetutils@gnu.org.", there is no distinction for vulnerabilities. [1]
There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26
One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose.
The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here.
Thanks to all of our heroes, op included.
TacticalCoder 42 minutes ago [-]
> The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here.
We know that the entirety of the AI movement is built on top of open-source projects like Linux and all the terminal and command line utilities. And runs inside projects doing god's work (say to contain the agents) like QEMU etc.
AI lives inside the work of our open-source heroes and would be absolutely nowhere without the work of all those people.
> Thanks to all of our heroes, op included.
Definitely, thanks GP and thanks to all our heroes.
43 minutes ago [-]
taftster 5 hours ago [-]
It's an unfortunate statement. And it does feel like it discredits you and the heroic efforts of those like you.
But this is probably forgiven as just sensationalism in writing, which is all too common. Not to excuse the author, but these types of writeups tend to drift into name calling and finger pointing a little too soon.
"Shamefully" is definitely the wrong word here, for sure.
JoshTriplett 3 hours ago [-]
> But this is probably forgiven as just sensationalism in writing
Why should we forgive sensationalism in writing at all?
saidnooneever 2 hours ago [-]
you are right they are entitled brats. usually they cant write good code themselves and they purposefully look for very old or low traffic code to find things that are 'old' etc. to make stupid uninteresting AI generated blog posts.
i have not seen a decent writeup in one of these clickbait things these ppl push out.
just ignore these types of ppl. its fine to fix the bugs ofc but what i mean is, ignore their attitudes. its a kids' attitude to life they keep
johnnyApplePRNG 2 hours ago [-]
Something tells me the NSA is none too pleased about the advent of LLMs.
Or is there a tradeoff?
Fewer ancient holes like this for their hackers but wide open access to anyone who installs codex or claude code?
notimetorelax 5 hours ago [-]
I really dislike articles that blow out of proportion the technical details. TLDR; bounds checking was missing leading to potential memory corruption.
ErroneousBosh 56 minutes ago [-]
> TLDR; bounds checking was missing leading to potential memory corruption.
... if you hold it just right, and let the light of the full moon shine through it on a particular day, while you send a carefully-crafted packet through the right brand of NIC over cables forged by long-forgotten smiths.
b800h 3 hours ago [-]
> "1994"
> "RISC was a distant dream"
Ahem
dspillett 2 hours ago [-]
Maybe I'm in a generous mood, but I would credit the writer with making a joke about the content of the film they had just mentioned and subsequently show a screen cap of work the subtitles for a line about RISC being a significant future technology, rather than being that historically inaccurate in their own tech memory.
krautsauer 4 hours ago [-]
Needs a (March 19)
(I know HN only does this for years, but this being about vulnerabilities…)
ErroneousBosh 57 minutes ago [-]
> In fact, this vulnerability was born so long ago (way back in 1994)
> That was so long ago that RISC was still a distant dream.
Yeah ARM would like to have a word with you. I'd been using RISC on the desktop for about five years by then and I was not an early adopter.
sjpb 4 hours ago [-]
If you're going to rip off xkcd pictures, I feel it'd be polite at least credit and/or link the original.
mitxela 4 hours ago [-]
FYI all signalling is in-band signalling
ErroneousBosh 54 minutes ago [-]
And all signals are analogue, if you're paying enough attention to the transients ;-)
khrbtxyz 4 hours ago [-]
A surprisingly long article for a one-line fix the authors didn’t send.
Skywalker13 3 hours ago [-]
Since AI is redacting, a lot of articles are long and boring to read with a lot of useless details.
5 hours ago [-]
6 hours ago [-]
jeffbee 4 hours ago [-]
RISC was not a distant dream in 1994 LMAO.
b800h 3 hours ago [-]
That made me spit out my tea. The prose was insulting.
eqvinox 1 hours ago [-]
I stopped reading on that line. The entire text is coming off as insulting, entitled and smug.
wolfi1 1 hours ago [-]
at that time even Intel had a RISC cpu (i960)
ErroneousBosh 52 minutes ago [-]
RISC desktop computers were common-ish in UK schools by then.
Of course if you count the 6502 as a RISC chip (if you squint a bit, Page Zero RAM sure does look like 256 8-bit registers to me!) then UK schools had RISC desktops for over a decade before then!
egorfine 20 minutes ago [-]
And this is why serious enterprises use telnetd exclusively instead of your childish ssh toy. See why? Because it's got ONE CVE in 3 decades as compared to a never-ending flow of security vulnerabilities in ssh. Security!
Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting.
[1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [3] https://www.openwall.com/lists/oss-security/2026/03/12/4
There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26
One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose.
[1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...
Thanks to all of our heroes, op included.
We know that the entirety of the AI movement is built on top of open-source projects like Linux and all the terminal and command line utilities. And runs inside projects doing god's work (say to contain the agents) like QEMU etc.
AI lives inside the work of our open-source heroes and would be absolutely nowhere without the work of all those people.
> Thanks to all of our heroes, op included.
Definitely, thanks GP and thanks to all our heroes.
But this is probably forgiven as just sensationalism in writing, which is all too common. Not to excuse the author, but these types of writeups tend to drift into name calling and finger pointing a little too soon.
"Shamefully" is definitely the wrong word here, for sure.
Why should we forgive sensationalism in writing at all?
i have not seen a decent writeup in one of these clickbait things these ppl push out.
just ignore these types of ppl. its fine to fix the bugs ofc but what i mean is, ignore their attitudes. its a kids' attitude to life they keep
Or is there a tradeoff?
Fewer ancient holes like this for their hackers but wide open access to anyone who installs codex or claude code?
... if you hold it just right, and let the light of the full moon shine through it on a particular day, while you send a carefully-crafted packet through the right brand of NIC over cables forged by long-forgotten smiths.
Ahem
> That was so long ago that RISC was still a distant dream.
Yeah ARM would like to have a word with you. I'd been using RISC on the desktop for about five years by then and I was not an early adopter.
Of course if you count the 6502 as a RISC chip (if you squint a bit, Page Zero RAM sure does look like 256 8-bit registers to me!) then UK schools had RISC desktops for over a decade before then!
/s