SoylentNews is people
SoylentNews
The 2017 Pwnie winner for lamest vendor response goes to Lennart Poettering for systemd. According to CSO which has reported on it, the Pwnie winners which were announced a few days ago, the summary for Lennart and systemd reads as follows:
The most spectacular mishandling of a security vulnerability by a vendor ended up winning a Pwnie for Lennart Poettering due to SystemD bugs 5998, 6225, 6214, 5144, 6237. The nomination reads: "Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie!"
(Score: 4, Informative) by Marand on Tuesday August 01 2017, @08:23AM
You missed much of the fun, then. Those were mostly interesting because the condescending attitude and the "I have no interest in helping you because you disagree with me about CVEs" shit at the end. The last one, while longer, does a better job of showing the arrogance + ignorance combination I mentioned. He's so caught up with arguing that usernames starting with a digit are invalid (they're not) and trying to prove it's NOTABUG WONTFIX that he basically ignores any evidence to the contrary, or dismisses that evidence as wrong.
Plus he completely misses that "systemd doesn't like this username, so systemd defaults to root" is a bad idea because it's unexpected privilege elevation, because it's technically working as intended (an invalid value for a setting will quietly revert to a default value, in this case root as the default user) and that's all that matters because it means he's right that it's NOTABUG. He won't even consider that maybe silently reverting to root instead of giving an error is a bad default behaviour.
And on the subject of ignorance, there's also this bug [github.com], where their home-grown "rm -rf" equivalent can follow ".." upward, eventually trashing the entire system. His immediate response is "I am not sure I'd consider this much of a problem. Yeah, it's a UNIX pitfall, but "rm -rf /foo/.*" will work the exact same way, no?" Which is bad enough by itself, because "that other program does it too!" is a poor justification for justifying your tool trashing the OS, but he's also wrong about it, and when others pointed it out he locked it to shut down people calling him out on not knowing fuck-all about how the OS he works on even operates.
Also, here's the video I referenced [youtube.com] in the previous comment about his "do you hate handicapped people?" remark. That part starts around 22:22 [youtu.be], and this is where he gets on stage at the end. [youtu.be] Most of it was tame, just a bit rude to be arguing with the presenter for so much of his presentation, but accusing the guy of disliking foreigners and disabled people over a disagreement about loading a full GNOME session for the login greeter was just shitty.