Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented.

However, there are also some open source project(s) that have been in existence for more than 10 years (maybe 15), and were included in all sorts of free and commercial products (OSes and linux distros, etc), and everyone just assumes it is correct, despite some parts of it in a state of despair and full of bugs.

It appears to me that the real users (programmers in-the-know) simply choose to use the library in a certain way as not to trigger the bug. Few choose to speak up.

There are also big-name companies that fix the bugs quietly (in their own products) without giving out any patches. And use that to their business advantage.

There is no leading developer. There is no information as to who are the active developers, except that you can browse the mailing list and see who has recently submitted patches, and assume that they might know someone who is helpful.

How should I handle a vulnerability case, without leaking information in a way that gives ammunition to the bad guys?

This question is a spin-off from: http://programmers.stackexchange.com/questions/5168/whats-the-biggest-software-security-vulnerabilty-youve-personally-discovered

share|improve this question
add comment

4 Answers

up vote 5 down vote accepted

Talk to Secunia (or any of the other bug databases), and let them handle it.

They do this on a daily basis, and probably already have a procedure for if they can't identify an appropriate contributor for a project.

(I would guess, if there's no contacts for the library itself, they'd contact major projects currently using the library, allowing any widespread software to fix/workaround any security issues, before releasing details to the public.)

share|improve this answer
    
Your advice seems to be relevant to my case. I'll wait for some more inputs from other people before I accept your answer, but I'll probably contact them right away. (Part of the frustration comes from knowing how to trigger the bug but not being able to create a fix for it.) –  rwong Oct 18 '10 at 11:23
add comment

To the coordinator(s).

If there is no clear info, I suggest you to pick one random contributor and ask him who is in charge.

Pick another contributor until you have a clear answer.

In any case, send the details about the problem to each person you contact.

share|improve this answer
    
I cannot find the real email addresses of any contributors. If I email the list directly, the contents are posted online immediately, risking disclosure. –  rwong Oct 18 '10 at 9:24
    
Then you are screwed. I wouldn't invest any more time in a project like that if I was you. –  user2567 Oct 18 '10 at 9:27
add comment

If the project is open source, then I don't see a problem posting your findings directly to the mailing list. Particularly if you have a patch already (but even if you didn't). If managed to tell someone about it "privately", as soon as they committed the fix to the repo (which I assume is public as well) everybody would know anyway.

share|improve this answer
add comment

Report the bug and if noone cares then clone the repository on github and fix the error there, and point to that repository in the original bugreport so others can get a fixed version.

Remember to merge the clone regularily to pick up other fixes.

share|improve this answer
    
ørn, forking the project should be the last resort as the codebases could be diff'd and exploits worked out from them. –  Huperniketes Oct 18 '10 at 11:47
    
"if noone cares"... I guess we are there. –  user1249 Oct 18 '10 at 11:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.