> This release contains security fixes. To give everyone time to upgrade, details will be added to this post in about a week.
Is this something that has been happening for a while or a new trend due to LLM concerns? I understand the reasoning, it just made me do a double take because I haven't really seen that before.
With Gitea specifically or in general? A lot of different software has silently included security fixes in updates combined with other changes and then later revealed what security fixes were made or stayed quiet about it all together, since long before LLMs could analyze changes.
Security researchers and malware authors would reverse engineer software updates of proprietary software, and scrutinise source code changes of open source projects to find secretly shipped security fixes.
(bias note: I am a project lead of Gitea) this approach is based on what peertube has been doing, and is being attempted as an alternative approach to what we've been doing previously due to feedback we've been receiving from the community.
The feedback was that we gave too many details too soon, and so we solicited feedback from the community and peertube's approach was given as a suggestion for us to try. But to be clear, this decision was discussed and made by the maintainers, including the elected leadership team. I'd say that this is a successful example of governance, as it isn't a unilateral decision, and everyone was involved in making.
That's quite annoying - "security fixes" - but no information if your installation is affected or not? (Eg: in a module that's disabled)?
Makes work harder for sys admins - little difference for black hats.
It's still a (<LLM> look at diffs in latest gitea release - find the patched security issues and write poc exploit for cve assessment) I guess?
ThePinion · · focus · HN ↗
Is this something that has been happening for a while or a new trend due to LLM concerns? I understand the reasoning, it just made me do a double take because I haven't really seen that before.
QuantumNomad_ · · focus · HN ↗
Security researchers and malware authors would reverse engineer software updates of proprietary software, and scrutinise source code changes of open source projects to find secretly shipped security fixes.
stackghost · · focus · HN ↗
IshKebab · · focus · HN ↗
techknowlogick · · focus · HN ↗
entrope · · focus · HN ↗
techknowlogick · · focus · HN ↗
e12e · · focus · HN ↗
Makes work harder for sys admins - little difference for black hats.
It's still a (<LLM> look at diffs in latest gitea release - find the patched security issues and write poc exploit for cve assessment) I guess?