Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx3.pub.mailpod2-cph3.one.com ([10.27.25.13])
	by mailstorage18.cst.mailpod2-cph3.one.com (Dovecot) with LMTP id e96FC/1xy1q8mwAAQS8vrQ
	for <filtered@awaresystems.be>; Mon, 09 Apr 2018 14:10:29 +0000
X-HalOne-ID: c136dc7a-3bff-11e8-8711-e0d84895d241
Received: from mail-oi0-f41.google.com (unknown [209.85.218.41])
	by mx3.pub.mailpod2-cph3.one.com (Halon) with ESMTPS
	id c136dc7a-3bff-11e8-8711-e0d84895d241;
	Mon, 09 Apr 2018 14:10:29 +0000 (UTC)
Received: by mail-oi0-f41.google.com with SMTP id q71-v6so7718638oic.6
        for <filtered@awaresystems.be>; Mon, 09 Apr 2018 07:10:29 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-original-authentication-results:x-gm-message-state:delivered-to
         :from:to:date:message-id:user-agent:in-reply-to:references
         :mime-version:subject:precedence:list-id:list-unsubscribe
         :list-archive:list-post:list-help:list-subscribe
         :content-transfer-encoding:sender:errors-to;
        bh=pZaQnVQrWgMUPirjPilrUHRB+DoSVoqjPefZUIjA5sw=;
        b=X1/Lx75hVezz6JJ/VS8ADKbOtSxghBFR+gwnDbW9P4HvlKBf/B2BSO4JSbq3NZeaBA
         fgOZ7NpPgQ7wGJ3P7id/aePifHELfYjWh+EkmHCN+BNrUg+rkRt6AnSbcg/xvcBR9bLG
         jHLDJwCB3FkJbL3+i2aoSImdxN4usO84DS3La9EZXux2DuXOi2E2ksmCZ4OfsCLgD9UD
         bFpqYoFzlTZqPY4nLkz3g5t3E49G+PLDFdDfxeS7N0MrvJ+ub65Q/EA36kNuqWS37KYw
         TF29914HNDJvg8TZGBSjEbauM04wqgaBFIGHCUWb7Xef/LQaNlHUS2+cVNLbIzsNKbMA
         hxGA==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
X-Gm-Message-State: ALQs6tDh74OZFgHsb+JJVWFC9LRyjmrQGWXQZQMMl0MYqkt6aKARm6Rs
	9ZKsimOSPSoLj9xRjcmSgSICcYj6/dLe9tQE6XcCINwQNYebDCM=
X-Received: by 2002:aca:cd11:: with SMTP id d17-v6mr23102116oig.291.1523283027514;
        Mon, 09 Apr 2018 07:10:27 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.74.210.156 with SMTP id h28csp2668146oos;
        Mon, 9 Apr 2018 07:10:26 -0700 (PDT)
X-Google-Smtp-Source: AIpwx4/pPUyBAacAGBDz8tXiL6zKvEvabhQyjTCZaBBIZKCWmtcFtHcfzGVpwaDLgCvrrQyocoSr
X-Received: by 10.223.142.214 with SMTP id q80mr24622473wrb.81.1523283026123;
        Mon, 09 Apr 2018 07:10:26 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1523283026; cv=none;
        d=google.com; s=arc-20160816;
        b=RdRq0jsyrGYaXTck2+doP+sSyCGID/GIcx3FSMFBup1Z8fmlW+6moNNtQ9qIW6NHBf
         viNrKVc4I1uDu2ADRM02XpI4frf8key7QCYgl0CdLG6/sMwzGY9IzJc7HG4VBDIq+9Dr
         dsqKOpzWLtDfGb8yrdY/WSWDAA7zPe9XIvL4A6Su0RJvwrpFOLedZTlnPTqTmE9C6JLS
         bzy3/Y6XXRlIiiWtr/7J10jwDMcobv3Z3v0m8xRV8K6E/SGfQvuBEHcUxJC63KsMPSix
         b59YYlLAky0hmbKIzrw7OoqpaNguPEpilZUjgU6SRKcxrVmFZEPkeb+N1FTQs9ZMwnEm
         LN6Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help
         :list-post:list-archive:list-unsubscribe:list-id:precedence:subject
         :mime-version:references:in-reply-to:user-agent:message-id:date:to
         :from:arc-authentication-results;
        bh=pZaQnVQrWgMUPirjPilrUHRB+DoSVoqjPefZUIjA5sw=;
        b=PJwUNMryXKscpsZTCU0UqOTCGfv9VnG/LWHWee+ePbW717hb05jvgKSMIwgtmblbcW
         xVybUcnhHOlKeNQIZ5A+/Dp/R1etzZiR1BXlbL60sjeNjtpgWeP632yjx/9TBU09MI1K
         YXA3cgMxC0NuWT+joFyt5xv6GAGwr++lvX+9D+uTaZGxYU7un+90PIN9P0eNnFtq/Qe+
         icKbSR3Nr0DfSOvHtaQwEZ+hndPCqGdOcg9hSx350F2UA/Sf/Zpr8Fsf2AaDN/zaRIHu
         wzBCLV1sZr9UxcFwgff2ZyUR0c+Gf+FTbLIy0wj3hDXZsRf9gMU+msLYpiBsyA6cKro2
         5Ssg==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
Return-Path: <tiff-bounces@lists.maptools.org>
Received: from lists.maptools.org (ks365428.kimsufi.com. [94.23.4.142])
        by mx.google.com with ESMTP id o46si320268wrf.103.2018.04.09.07.10.25;
        Mon, 09 Apr 2018 07:10:26 -0700 (PDT)
Received-SPF: neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=94.23.4.142;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 77B7735C04B;
	Mon,  9 Apr 2018 09:09:37 -0500 (EST)
Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net
	[217.70.183.201])
	by lists.maptools.org (Postfix) with ESMTPS id BE41135C049
	for <tiff@lists.maptools.org>; Mon,  9 Apr 2018 09:09:29 -0500 (EST)
X-Originating-IP: 88.162.84.61
Received: from even-i700.localnet (unknown [88.162.84.61])
	(Authenticated sender: test@spatialys.com)
	by relay8-d.mail.gandi.net (Postfix) with ESMTPSA id 070DD1BF20C;
	Mon,  9 Apr 2018 16:09:28 +0200 (CEST)
From: Even Rouault <even.rouault@spatialys.com>
To: tiff@lists.maptools.org
Date: Mon, 09 Apr 2018 16:09:25 +0200
Message-ID: <4017466.xPSel8RVU8@even-i700>
User-Agent: KMail/5.1.3 (Linux/4.4.0-104-generic; KDE/5.18.0; x86_64; ; )
In-Reply-To: <alpine.GSO.2.20.1804090810210.25280@freddy.simplesystems.org>
References: <CABj5TKTJeeQ+O37e7tyPaftUeV6Hemu3r0oZFjumYZisU9KJ1A@mail.gmail.com>
	<CABj5TKT31YCSpJgYstnBqPtg+oyJO8n03vEbJa81RP8MDTpsJQ@mail.gmail.com>
	<alpine.GSO.2.20.1804090810210.25280@freddy.simplesystems.org>
MIME-Version: 1.0
Subject: Re: [Tiff] fuzzing libtiff with google's oss-fuzz
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On lundi 9 avril 2018 08:44:02 CEST Bob Friesenhahn wrote:
> If sufficient libtiff maintainer time/energy is not immediately 
> available then enrolling in oss-fuzz will result in a great many 
> issues being reported in libtiff and exposed to public view (along 
> with files to cause the problem) which are not yet fixed.  This would 
> be harmful to users.  There has to be enough volunteer maintainer 
> time/energy to get issues resolved and into a libtiff release in 90 
> days time.  Actually, after a problem is fixed in the Git repository, 
> the issue is made public in just 30 days so there needs to be many 
> releases in order to ensure that there is a release before the issues 
> are made public.

Bob,

I somehow understand your position on it, but you are probably assigning you 
more responsability than you should. On our volunteer time, we have no moral 
or whatsoever obligations regarding anyone to fix any issues. For that reason, 
I'm less and less willing to treat with privately reported issues.

Black hat hackers can already use oss-fuzz infrastructure locally (this is how 
you set up oss-fuzz initially by the way) to find issues, so we can assume 
that vulnerabilities are already known by them, this way or another. Having 
them publicly reported through oss-fuzz is better I think.

I don't think it really matters if bugs are not fixed in the 90 day delay. If 
they matter to people, they will look at the public issues and try to fix them 
and issue pull requests. Or fund people to fix them.

Even

-- 
Spatialys - Geospatial professional services
http://www.spatialys.com
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
