logoalt Hacker News

collinfunk • today at 4:41 AM • 4 replies • view on HN

As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled:

    Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing).
The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch.

Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting.

[1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [3] https://www.openwall.com/lists/oss-security/2026/03/12/4

Replies

x______________ • today at 5:31 AM

The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here.

Thanks to all of our heroes, op included.

➕ show 2 replies
croemer • today at 9:40 AM

Thanks for maintaining telnet.

  The bug was reported on a public mailing list, which is sadly common nowadays
In defence of the reporter, your Readme only says "Send bug reports to [email protected].", there is no distinction for vulnerabilities. [1]

There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26

One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose.

[1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...

taftster • today at 5:08 AM

It's an unfortunate statement. And it does feel like it discredits you and the heroic efforts of those like you.

But this is probably forgiven as just sensationalism in writing, which is all too common. Not to excuse the author, but these types of writeups tend to drift into name calling and finger pointing a little too soon.

"Shamefully" is definitely the wrong word here, for sure.

➕ show 1 reply
saidnooneever • today at 7:13 AM

you are right they are entitled brats. usually they cant write good code themselves and they purposefully look for very old or low traffic code to find things that are 'old' etc. to make stupid uninteresting AI generated blog posts.

i have not seen a decent writeup in one of these clickbait things these ppl push out.

just ignore these types of ppl. its fine to fix the bugs ofc but what i mean is, ignore their attitudes. its a kids' attitude to life they keep