For @ifin folks, I started a discussion about this on the Discourse here: https://discourse.ifin.network/t/carrot-disclosure-forgejo/

[cxiao@infosec.exchange]

RE: https://infosec.exchange/@jvoisin/116488420408417722

For @ifin folks, I started a discussion about this on the Discourse here: https://discourse.ifin.network/t/carrot-disclosure-forgejo/

My personal thought is that I appreciate, as a defender, knowing this information about a project having a systematic lack of security.

[oilheap@infosec.exchange]

@cxiao @ifin "carrot disclosure" wtf. This is not the most stupid thing I've seen this week, but it's up there. This helps nobody and only inflates the ego of the researcher. The fact that they considered "sellability" of these issues already gives enough insight.

[kouhai@social.treehouse.systems]

@oilheap @cxiao @ifin for what it’s worth, we (treehouse staff and community) had a productive discussion with the author on discord; hopefully further updates will trickle out over the next days

[cxiao@infosec.exchange]

@kouhai @oilheap @ifin TY! I'm a little surprised by the extreme negative reactions to this TBH. From the perspective of being a Forgejo or other OSS maintainer it sucks to see this. But at the end of the day attackers don't care and aren't going to tell you in this way, or any way, that you have serious issues

[demize@unstable.systems]

@cxiao @kouhai I can understand the negative reaction; telling a well-respected and very open source project “you have serious issues but I’m not going to tell you what they actually are” without any attempt to actually flag the issues to them is… not great? it’s not like this is a company that can bring in someone to audit the code, it’s an open source project that would love to fix the issues but is resource constrained by virtue of being an open source project

it’s an inherently aggressive approach to disclosure and it doesn’t come off as “helpful” nearly as much as “condescending”, and while that’s one thing to direct at a corporation…

[kouhai@social.treehouse.systems]

@cxiao @oilheap @ifin one of the objections I’ve seen is “carrot disclosure doesn’t work when you’re punching downwards or sideways”/ “what additional resources can a volunteer-based project apply?”

(not focusing on the other objections, because I don’t want to retread the productive discussion from earlier)

[oilheap@infosec.exchange]

@cxiao @kouhai @ifin oh, so this is not a researcher but a malicious party? Then we should prosecute them!