Re: ZDI-CAN-33367: New Vulnerability Report

[Jamal Hadi Salim]

On Thu, Oct 22, 2026 at 5:20 PM Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
>
> On Thu, Oct 22, 2026 at 09:34:45PM +0200, Willy Tarreau wrote:
> > > We will have some discussions internally, but in the meantime, we will send the cases to you as we always have.
> > > If you don't want to do anything with it, that's fine too. We will release the findings at rejection, or 120 days.
> > > Whichever comes first.
> >
> > The main problem we're having is that it's not possible to have anyone on
> > your side nor the reporter test a patch. But I won't rehash this, it's not
> > new, but *this* is what makes your reports way more painful to deal with
> > than many other ones. You (unvoluntarily it seems) act as an insulation
> > layer between reporters and develoeprs and that really doesn't help.
>
> This; Willy is far more eloquent than I am, but the zdi reports have
> been very painful. And as said; this has been raised a fair number of
> times.

+1 (from experience)
They just dump stuff and run. They wont even respond to basic
questions about what they send.
It looks like those parking enforcement people who have a quota of
parking tickets to meet on a friday.
As Willy mentioned, on the positive side, though they do produce good
reports (although once or twice the repros didnt work)

cheers,
jamal