146
Dev rejects CVE severity, makes his GitHub repo read-only (www.bleepingcomputer.com)
submitted 2 years ago by to c/programming@programming.dev
9 comments fedilink hide all child comments
 
  • The developer of the 'node-ip' project made the GitHub repository read-only after disputing the severity of a reported vulnerability (CVE-2023-42282).
  • The vulnerability involved incorrect identification of private IP addresses in non-standard formats, but the developer argued it had a dubious security impact.
  • The situation highlights ongoing issues with unverified CVE reports causing unnecessary panic and frustration for open-source project maintainers.
you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 2 years ago (1 child)

Clearly it wasn't maintained.

Lol. It's an IP library. IP classifications haven't changed. What could he possibly update?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 2 years ago (1 child)

    There's a whole bunch of pull requests and issues sitting there for a start.

    Personally I'd also update the example in the readme and set an engine value in the package.json file.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 2 years ago

    Then fork it and do that.

    These projects are structured as hobbyist projects and get whatever time the maintainer can spare. I have projects like that, they're useful, but I'm not gonna prioritize them over... anything else, come to think of it.

    The fact so many people treat a hobbyist project with one maintainer as critical infrastructure is insane, but that's on them. Everybody likes free software, nobody likes to help or pay the maintainer.

  • permalink
  • fedilink
  • source
  • parent