Announcements

[–] machinaeZER0@lemm.ee 9 points 3 years ago

Somebody should give that guy a raise!

parent

[–] startlefrenzy@lemmy.world 37 points 3 years ago (1 child)

Glad to see Lemmy is responding quick to exploits. Does Lemmy have a plan to prevent any other exploits that may be lying around such as a routine security audit?

[–] nutomic@lemmy.ml [S] 70 points 3 years ago (1 child)

All the code is open source, everyone is welcome to look through it for potential problems and report/fix them. we dont have any money to pay for a professional audit. Maybe there are some organizations which would do audits of open source projects for free, might be worth searching for.

parent

[–] Zeth0s@lemmy.world 25 points 3 years ago (2 children)

We use sonarqube for code analysis that is pretty nice and has a community edition. It isn't a bullet proof solution, but it is pretty convenient for maintainers and reviewers of PRs. The only thing missing from the enterprise edition are useless flashy dashboards to show to people who don't understand computers

hideshow 4 child comments

parent

[–] lowleveldata@programming.dev 10 points 3 years ago (3 children)

I do have a Sonarqube server somewhere around. Is it considered an annoying behavior to scan an open source project and open issues for others to fix?

hideshow 6 child comments

parent

[–] nutomic@lemmy.ml [S] 23 points 3 years ago (1 child)

That depends, it would be annoying if you open lots of issues for minor, unimportant issues. But if you find a few major problems its good to report them. Of course its always ideal if you submit fixes as well, because there are never enough devs.

parent

[–] lowleveldata@programming.dev 7 points 3 years ago

I'm way too lazy to code when I'm off work

parent

[–] JoeKrogan@lemmy.world 3 points 3 years ago

I think its better to detect something early even if there is not a fix as it at least can be triaged and others can fix it if the original reporter is unable to devote the time or whatever

parent

[–] Zeth0s@lemmy.world 2 points 3 years ago

Better ask the lead developers... :)

parent

[–] mrmanager@lemmy.today 2 points 3 years ago (1 child)

But can it do excel? /s

parent

[–] Zeth0s@lemmy.world 1 point 3 years ago

No, you are right... Time to hire 3 PMOs per developer to copy and paste random numbers in well formatted tables on outlook, and send it around in the mailing list with CIO and directors.

And publicly shame developers if some meaningless number goes down

parent

[–] lvxferre@lemmy.ml 17 points 3 years ago (1 child)

Given that the exploit was literally yesterday, you guys are damn fast!

[–] shellshock@reason.rocks 3 points 3 years ago*

Yeah this was a fast turnaround, they did a great job. Autocorrect messed me up

parent

[–] lckdscl@whiskers.bim.boats 9 points 3 years ago

Thanks for the prompt fixes

[–] ulu_mulu@lemmy.world 5 points 3 years ago

Thank you for reacting so quickly!

[–] ravermeister@lemmy.rimkus.it 5 points 3 years ago

and docker images for arm64 are ready as well :)

[–] gabriele97@lemmy.g97.top 3 points 3 years ago

Thanks!

[–] DonDino@mujico.org 1 point 3 years ago

is it me or front is broken?

[–] entropy@not.alazy.dev 1 point 3 years ago

Thanks for the quick update on this!

[–] nick@nickbuilds.net 1 point 3 years ago

Hey one quick question.. the Ansible playbook doesn't look like it's been updated to 0.18.2 or at least the instructions don't state how to pull it. Any chance this could get fixed/clarified in the release notes?