Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn't taking the advice
  • snooggums@piefed.worldEnglish
    13·
    15 days ago

    The two comments on the article dismiss the concern as ‘possibly showing the wrong version’ but all it would have taken the dev to do would be to respond with the fact that it is up to date and displaying incorrectly. That would take less effort than blocking and being a jerk about someone trying to bring a security concern to their attention.

    • entwine@programming.devEnglish
      15·
      15 days ago

      Seems like he has an attitude/maturity problem, as he took the criticisms very personally. This isn’t the type of person you’d ever want to work with, and certainly not the type of person you should trust with your data.

    • CmdrShepard49@sh.itjust.worksEnglish
      6·
      14 days ago

      The author of this article seems like the jerk to me and acts like he just found a major vulnerability in Android or something not a free app that collects no PII.

    • Orygin@sh.itjust.worksEnglish
      5·
      14 days ago

      It’s bogus security concern and seems like a smear campaign because the dev did not respond “properly”.
      Anybody who has set up a webserver on debian or redhat will tell you that apache versions mean nothing. They backport fixes and security patches to seemingly ancient versions of Apache, and then every security scanner will tell you they are vulnerable while actually they are not and have been fixed for years.
      I had to fight the security team at my old job because of this very same thing. Just check the redhat/debian release logs for apache and you’ll see the CVE have been fixed.
      Doing a whole blog post to shit on the project, then make a bogus security claim while giving them a way too short notice (1.5h is insane) to fix before going public is in extremely bad taste. I totally understand the dev blocking the guy as he contributed nothing here.

      Edit: From the blog:

      Without providing more details, I also discovered that his server is running outdated software with known vulnerabilities.

      Tell me you don’t know anything about security without saying it. Anybody worth their salt will know backporting exists.
      This is just trying to smear the dev while looking like a fool. Anybody capable of opening the dev tools and checking the header would see the same thing. Guess what? Lots of bots do that already and automatically try known CVEs.

      Second edit: not trying to rub people the wrong way, but commenters here should really stop giving their opinions on stuff they don’t understand. Yes security is important, but no, an older apache version in the header is not an issue.

      • entwine@programming.devEnglish
        2·
        13 days ago

        Two things can be right at the same time:

        • this particular security concern is bogus
        • the ICE Block dev is full of shit

        Idk anything about the author, but besides the apache version thing, he did bring up some very valid criticisms. The previous article they wrote is worth a read, or at the very least, it’s worth watching the snippets of that HOPE interview. It’s obvious the developer is a hardcore bullshitter, which is the most charitable interpretation giving him the benefit of the doubt (without speculation about malicious intent)