And I wouldn't have gotten into a pointless fight if Rimu didn't randomly pick one by saying that simple criticism was "coordinated harassment". But you do you. ¯_(ツ)_/¯

Thats just your opinion. You can criticise as much as you want, but Piefed is part of the Fediverse and neither of us can change that. I prefer to get along well rather than getting into pointless fights, but you do you.

Cool. I am not making demands of the developer. I'm just saying that his behavior is problematic as hell. Honestly, so is yours if you're going to repeatedly dodge the point being made. Problematic behavior doesn't get to be dismissed just because its open source. People are allowed to criticise something even if it is open source. That defense is worthless.

Piefed is an open source project which is provided for free by volunteers. You dont have any right to make demands to the developers. If you dont like it, fork or ignore it.

Invalid comparison. Rimu is not a simple admin, he is a dev of the leading alternate competitor to Lemmy and is personally hardcoding his bias into the project itself.

You want to try that again but with a more accurate comparison?

Worth pointing out here that this is the mentality of the oh so authoritarian and scary communist devs of Lemmy, while the "anti-authoritarian" one is making sure to insert as much as possible of his personal bias hardcoded into the project and then lash out at random people for calling him out on it.

Sorry to continue the infighting a bit but the contradiction here is just glaring. I appreciate your stance and the Fediverse would never be what it is without people like you

Many people would say the same thing about the admins of various different Lemmy instances. In the end admins can do whatever they want on their own instance, thats how the Fediverse works. Whats important is that they can only do these things on their own site. So if you dont like it, just block and move on.

It's been 20 years since Microsoft cryptographer Niels Ferguson said "Over my dead body" about a BitLocker backdoor. But the very next line of that blog post was "Well, maybe not literally---I’m not ready to be a martyr quite yet---but certainly not in any product I work on" and he doesn't work there anymore 🤔

(Ferguson was also one of the cryptographers who pointed out the backdoor-enabling design of NIST's Dual_EC_DRBG in 2007, six years before the Snowden disclosures confirmed that NIST did indeed backdoor it on behalf of the NSA.)

⢰⣶⣤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀
⠀⣿⣿⣿⣷⣤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⣶⣾⣿
⠀⠘⢿⣿⣿⣿⣿⣦⣀⣀⣀⣄⣀⣀⣠⣀⣤⣶⣿⣿⣿⣿⣿⠇
⠀⠀⠈⠻⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠋⠀
⠀⠀⠀⠀⣰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⠋⠀⠀⠀
⠀⠀⠀⢠⣿⣿⡏⠆⢹⣿⣿⣿⣿⣿⣿⠒⠈⣿⣿⣿⣇⠀⠀⠀
⠀⠀⠀⣼⣿⣿⣷⣶⣿⣿⣛⣻⣿⣿⣿⣶⣾⣿⣿⣿⣿⡀⠀⠀
⠀⠀⠀⡁⠀⠈⣿⣿⣿⣿⢟⣛⡻⣿⣿⣿⣟⠀⠀⠈⣿⡇⠀⠀
⠀⠀⠀⢿⣶⣿⣿⣿⣿⣿⡻⣿⡿⣿⣿⣿⣿⣶⣶⣾⣿⣿⠀⠀
⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡆⠀
⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀

Rimu basically seems to be building a cult.

With how Rimu has been behaving recently, I wouldn't be surprised if he just started screaming that the vulnerability doesn't exist if you brought him up to him privately. He doesn't listen to anyone but himself and pressure on his ego. Reasonable admins get reasonable responses. Tyrants can cry about it.

Blaze has lot all respect and credibility from me. He will criticize what he does not like and dismiss criticism of what he does. I used to think he was reasonable and at least listen to others but, from what I can tell, all he does is pretend to sit on the fence while having some pretty strong opinions with his toes in the grass.

Brother, Rimu is an enemy of the fediverse. Why? Because he re-created reddit. He basically reinvented shadow banning, controls the narrative of his instance, actively keeps spreading misinformation about other instances and users, will actively suppress certain instances using his platform and lashes out against criticism like a petty tyrant.

I'm tired of this nonsense that "We're all here to leave reddit!" Yes. We are here to leave reddit. So stop giving Spez 2.0 a pass.

In general I agree, but we're in a period right now where we have a new kind of tool that's able to comb through large codebases and connect the dots that would be difficult for a human to do. My main point here is that open source maintainers need to be aware of this, and to use LLMs themselves to see if any issues can be surfaced.

wait til they find out you can create scripts with llms!

Open source projects are particularly vulnerable here since anybody can just grab the source and throw an LLM at it to see if it can find exploits.

On the other hand, this means that they should end up more secure. Open-source projects get far, far more vulnerability testing than closed-source projects. Security holes in closed-source systems can exist for years at a time, which is how things like the Pegasus malware work (undisclosed security holes).

I guess we disagree on whether this information had much value to begin with. It did however result in a fix, and people are now aware of just how easily attackers can find vulnerabilities now. I will refrain publishing the details in the future though.

Sorry, but I do not accept this argument.

Again, you do not know that it was already known to any malicious actor, but by disclosing it publicly, guaranteed that it would be.

This looks very much like a hostile act, doubly so given the overall context. I say this as someone who generally agrees with you on a lot of stuff!

That's fair, I'll refrain form this sort of up front disclosure in the future.

Since it affects people running the software and very likely to be known to any malicious actor I would argue so. I'll stress again that this was not information that took any effort to find. Literally a few minutes of effort.

Exactly - so why is this a bug that should be disclosed publicly

Responsible disclosure is still important because it takes the developer time to develop, validate and release a securit fix. Keep in mind that open source projects like Piefed, Lemmy and others are developed by volunteers in their free time. So it is irresponsible to publish security problems without any private warning. For all the infighting that is happening, we need to remember that our enemy is Reddit, and not anyone on the Fediverse.

Wait till you find out that the human brain is also a non-deterministic system.

sorry - you used a non-deterministic system to find a bug, and you're saying there's no duty to disclose responsibly because someone else could maybe use a similar system to maybe find that bug?

Edit: elsewhere you say this

Since the exploit is very easy to find, it should be assumed that malicious people would have found it as well

While it's possible that someone else has found it, this is not a reason to hand it to malicious people on a platter.

It would all depend on the rate of false positives, and as you say, we'd have to wait and see how this plays out. At the very least, what I'd want people to take away from this is that project maintainers absolutely should be using these tools themselves. They're the people who are in the best position to decide whether something is a real issue, and it's better to be safe than sorry here.