sullivanmatt

Yeah, that's how many companies with open ecosystems work. If you're using e.g. RedHat, you are getting packages with embargoed fixes baked into them before those fixes hit public repos. Node.js, OpenSSL, Git itself all do this.

You can argue about whether the "publicly announced existed" part since they don't advertise for any single package, but that's the ecosystem you buy into.

That's not what's being said, at all. They are simply telling their enterprise customers that there is a different build pathway for the enterprise builds and that pathway wasn't impacted by this issue.

Also if you don't like organizations fixing vulns without releasing the open source first, you're going to be upset when you learn how every major vuln and associated patches are distributed long before the fixes hit the repos. A timely example of this is PHP, literally today.

Again, this would be local inference via DeepSeek. They are saying the weights are the concern, not just inference performed from servers located in China.

Completely agree. My wife and I absolutely loved it. Tons of fun, and unexpectedly quite intelligent.

It's perfectly possible it's someone with deep domain experience, or someone who has product design or management skills. Regardless, dismissing these people out of pocket is not likely the best choice.

I'm no longer living in Oregon but remain closely connected. I can't opine to the behavioral challenges, but in terms of the raw score drop I think there's also the one-two punch here of:

1) Schools were closed from Covid for a long time. Not here to debate whether that was good/bad/otherwise, but it is factually accurate to say Oregon schools remained remote longer than almost any others in the country, and we now know the duration of closure had pretty direct influence on learning outcomes.

2) In the past decade the Portland metro area has seen an influx of migration from economically disadvantaged families who are immigrants / first generation citizens / non-native English speakers in the home. Students from these families are lagging significantly behind their peers in terms of post-Covid recovery, which if I recall correctly, follows national trends as well.

My first employer is now a decently well known B2B SaaS and we didn't build user interfaces to manage various settings for a very long time. For example, we supported custom fonts, but we would have to jack into production to upload them and manually configure the database to make them available to a given customer. That ability didn't become customer-facing for a decade, simply because it was easier to file a ticket and make an SRE do it.

This is a little tangential but another good piece of advice is to avoid over optimization of the engineering stack. A giant monolith running on the largest RDS instance AWS provides a lot more runway than people realize.

In all of these advisories there has never once been a mention of cloud being vulnerable. I think it's safe to assume cloud runs a similar, if not identical, codebase, and that these issues are simply patched there first before vulnerability announcements are published. But that's the type of thing no company is ever going to be willing to say in public.

There must be a specific set of libs present on the victim (client), correct. Qualys claims that stock Ubuntu Desktop systems often have these libs, and that they haven't looked into whether other distros tend to.

But yes, your point stands. Huge number of preconditions here to fulfill.

This sounds way worse than it is.

To be clear, the "remote" part of the code execution is that an attacker controlling your destination server can cause your client to run an attacker-controlled payload, if the client is forwarding their credentials (`ssh -A`). Most people don't tend to make connections to arbitrary SSH hosts, and certainly they don't do it while forwarding their credentials along.

It's a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.