Comments on: When is a crashing MySQL bug not a bug? http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/ Expert times and information on MySQL Thu, 09 May 2013 15:50:26 +0000 hourly 1 http://wordpress.org/?v=3.0.4 By: Tech Crunch: Culture Clash & Oracle Makes More Moves To Kill Open Source MySQL | Timsiu's Blog http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-16418 Tech Crunch: Culture Clash & Oracle Makes More Moves To Kill Open Source MySQL | Timsiu's Blog Sun, 28 Oct 2012 10:24:46 +0000 http://ronaldbradford.com/blog/?p=4100#comment-16418 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressedhere and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressedhere and here. [...]

]]> By: Shantanu Oak http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15896 Shantanu Oak Thu, 13 Sep 2012 12:47:35 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15896 ... Because "All people are equal but some are more equal than others!" Oracle is obviously trying to protect it's company interest and I do not see anything wrong in it. The community / customer will pay the price for non-transparency and the price is always fair once paid in full. … Because “All people are equal but some are more equal than others!”
Oracle is obviously trying to protect it’s company interest and I do not see anything wrong in it.
The community / customer will pay the price for non-transparency and the price is always fair once paid in full.

]]> By: State of the MySQL forks | OpenLife.cc http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15582 State of the MySQL forks | OpenLife.cc Tue, 21 Aug 2012 13:35:20 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15582 [...] big news this week was the reports by Ronald Bradford (consultant), Sergei Golubchik (MariaDB) and Mark Callaghan (Facebook) that Oracle has yet again tightened the [...] [...] big news this week was the reports by Ronald Bradford (consultant), Sergei Golubchik (MariaDB) and Mark Callaghan (Facebook) that Oracle has yet again tightened the [...]

]]> By: Hank Eskin http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15581 Hank Eskin Tue, 21 Aug 2012 12:52:53 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15581 I filed the original bug 65740. What concerns me is that I'm not sure this qualifies as "A crash caused by non admin users is considered a privilege escalation." since two independent conditions must be met before the crash happens: 1. Some form of "replicate-wild-ignore-table" or "replicate-ignore-table" has to exist in the my.cnf file 2. An update statement using @ variables (this statement my crashing slave: "update test set rank=@rnk:=@rnk+1") Only the update statement can be submitted by a non-admin user. Only an admin user can add the replicate-ignore statements to the my.cnf file in order to cause a crashing slave. If there are no "replicate-ignore" statements in the my.cnf file, the update statements work as expected without crashing the slave. So I don't see why this is a security hazard triggered by a non-admin user. Finally, if the bug itself is replicated and marked as duplicates elsewhere in the MySQL bug database (and Percona's), then what exactly is being accomplished by marking the original bug as private? I filed the original bug 65740. What concerns me is that I’m not sure this qualifies as “A crash caused by non admin users is considered a privilege escalation.” since two independent conditions must be met before the crash happens:

1. Some form of “replicate-wild-ignore-table” or “replicate-ignore-table” has to exist in the my.cnf file
2. An update statement using @ variables (this statement my crashing slave: “update test set rank=@rnk:=@rnk+1″)

Only the update statement can be submitted by a non-admin user. Only an admin user can add the replicate-ignore statements to the my.cnf file in order to cause a crashing slave. If there are no “replicate-ignore” statements in the my.cnf file, the update statements work as expected without crashing the slave.

So I don’t see why this is a security hazard triggered by a non-admin user.

Finally, if the bug itself is replicated and marked as duplicates elsewhere in the MySQL bug database (and Percona’s), then what exactly is being accomplished by marking the original bug as private?

]]> By: Ricardo Parente's Blog » Oracle Makes More Moves To Kill Open Source MySQL http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15580 Ricardo Parente's Blog » Oracle Makes More Moves To Kill Open Source MySQL Tue, 21 Aug 2012 12:33:48 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15580 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill MySQL | KlineTel http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15578 Oracle Makes More Moves To Kill MySQL | KlineTel Tue, 21 Aug 2012 07:20:21 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15578 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL via Techcrunch.com - Edno360 http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15577 Oracle Makes More Moves To Kill Open Source MySQL via Techcrunch.com - Edno360 Tue, 21 Aug 2012 05:57:33 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15577 [...] The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle、オープンソースのMySQL潰しに次の一手 http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15574 Oracle、オープンソースのMySQL潰しに次の一手 Tue, 21 Aug 2012 00:55:21 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15574 [...] OracleがMySQLの利用を可能な限り困難にしようとしていることは明白だ。その結果デベロッパー・コミュニティーでは、Oracelが何をオープンと考え何をクローズドと考えるかに関する不信の波が広がっている。デベロッパーに起きている問題は、ここやここに、さまざまな形で表現されている。 [...] [...] OracleがMySQLの利用を可能な限り困難にしようとしていることは明白だ。その結果デベロッパー・コミュニティーでは、Oracelが何をオープンと考え何をクローズドと考えるかに関する不信の波が広がっている。デベロッパーに起きている問題は、ここやここに、さまざまな形で表現されている。 [...]

]]> By: Verschleiert Oracle MySQL-Informationen? - Der Softwareentwickler Blog http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15571 Verschleiert Oracle MySQL-Informationen? - Der Softwareentwickler Blog Mon, 20 Aug 2012 19:11:44 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15571 [...] berichtet Ronald Bradford in seinem Blog von einem kritischen Fehler, der eine komplette MySQL-Datenbank zum Crashen [...] [...] berichtet Ronald Bradford in seinem Blog von einem kritischen Fehler, der eine komplette MySQL-Datenbank zum Crashen [...]

]]> By: Linux, BSD un citas lietas - Atvērtajās ziņās | MySQL pamazām zaudē atvērtību? http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15567 Linux, BSD un citas lietas - Atvērtajās ziņās | MySQL pamazām zaudē atvērtību? Mon, 20 Aug 2012 14:50:31 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15567 [...] un citu ar MySQL saistīto projektu dalībnieki izteikuši bažas par to, ka ir pārtraukta svarīgu komponentu koda publiskošana. MySQL pakāpeniski pārvēršas [...] [...] un citu ar MySQL saistīto projektu dalībnieki izteikuši bažas par to, ka ir pārtraukta svarīgu komponentu koda publiskošana. MySQL pakāpeniski pārvēršas [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15559 Oracle Makes More Moves To Kill Open Source MySQL Mon, 20 Aug 2012 06:10:58 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15559 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed hereand here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed hereand here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL - The Review Blog http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15555 Oracle Makes More Moves To Kill Open Source MySQL - The Review Blog Sun, 19 Aug 2012 23:05:40 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15555 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: MySQL теряет былую открытость — прекращена публикация тестовых наборов и лога изменений : Записки начинающего линуксоида http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15551 MySQL теряет былую открытость — прекращена публикация тестовых наборов и лога изменений : Записки начинающего линуксоида Sun, 19 Aug 2012 20:04:40 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15551 [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...] [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...]

]]> By: Wordpress Themes » Blog Archive » Oracle Makes More Moves To Kill Open Source MySQL http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15537 Wordpress Themes » Blog Archive » Oracle Makes More Moves To Kill Open Source MySQL Sun, 19 Aug 2012 09:21:40 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15537 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: MySQL -> TheirSQL? | Lindeas http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15535 MySQL -> TheirSQL? | Lindeas Sun, 19 Aug 2012 08:22:58 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15535 [...] на списъка с промените и на тестовите скриптове. Така не се разбира какви грешки всъщност са отстранени в тази версия и никой външен [...] [...] на списъка с промените и на тестовите скриптове. Така не се разбира какви грешки всъщност са отстранени в тази версия и никой външен [...]

]]> By: MySQL теряет былую открытость — прекращена публикация тестовых наборов и лога изменений | Интересное в сети http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15530 MySQL теряет былую открытость — прекращена публикация тестовых наборов и лога изменений | Интересное в сети Sun, 19 Aug 2012 06:03:09 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15530 [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...] [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Startup Help http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15528 Oracle Makes More Moves To Kill Open Source MySQL | Startup Help Sun, 19 Aug 2012 04:32:49 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15528 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Hosting In http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15524 Oracle Makes More Moves To Kill Open Source MySQL | Hosting In Sun, 19 Aug 2012 03:32:52 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15524 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL - VitalIT | VitalIT http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15523 Oracle Makes More Moves To Kill Open Source MySQL - VitalIT | VitalIT Sun, 19 Aug 2012 03:20:05 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15523 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | AkimoLux.com http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15522 Oracle Makes More Moves To Kill Open Source MySQL | AkimoLux.com Sun, 19 Aug 2012 03:04:05 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15522 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Crowdfunding News http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15518 Oracle Makes More Moves To Kill Open Source MySQL | Crowdfunding News Sun, 19 Aug 2012 02:26:14 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15518 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Krantenkoppen Tech http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15517 Oracle Makes More Moves To Kill Open Source MySQL | Krantenkoppen Tech Sun, 19 Aug 2012 02:03:42 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15517 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | E-7 http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15514 Oracle Makes More Moves To Kill Open Source MySQL | E-7 Sun, 19 Aug 2012 01:39:58 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15514 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Gaster Tech Blog http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15513 Oracle Makes More Moves To Kill Open Source MySQL | Gaster Tech Blog Sun, 19 Aug 2012 01:27:14 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15513 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | Welcome To My Site http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15508 Oracle Makes More Moves To Kill Open Source MySQL | Welcome To My Site Sun, 19 Aug 2012 00:09:12 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15508 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: Oracle Makes More Moves To Kill Open Source MySQL | TechCrunch http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15504 Oracle Makes More Moves To Kill Open Source MySQL | TechCrunch Sat, 18 Aug 2012 23:38:51 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15504 [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...] [...] It’s pretty clear that Oracle is trying to make it as difficult as possible to use MySQL. The result is a wave of unsettlement in the developer community about what Oracle considers open and what it sees as closed. The move is causing problems for developers in all manner of ways as expressed here and here. [...]

]]> By: MySQL теряет былую открытость | AllUNIX.ru — Всероссийский портал о UNIX-системах http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15500 MySQL теряет былую открытость | AllUNIX.ru — Всероссийский портал о UNIX-системах Sat, 18 Aug 2012 15:50:29 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15500 [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...] [...] MariaDB и других связанных с MySQL проектов выразили опасение в связи с прекращением публикации некоторых важных [...]

]]> By: Jean-Christophe Petit http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15499 Jean-Christophe Petit Sat, 18 Aug 2012 15:30:03 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15499 Hello Ronald, we also open a bug #65831 (http://bugs.mysql.com/bug.php?id=65831) and it was mentioned as a duplicate of yours by Valeriy Kravchuk. And then it was crossed out.. When we tried to look at your bug, the only message displayed was "You do not have access to bug #65740" (bug was mark as private) Thank to Google cache, we were able to look into it and it looks in fact very similar to yours.. Why did your bug was marked as private but not ours ? When we looked into the changes of 5.5.27, there is no mention of either your bug or ours ?? We also never received a notification that our bug was fixed, or was it ? Message from Hank Eskin is not clear as he mentioned your bug number but crossed out.. Note: an other similar bug listed in Percona (https://bugs.launchpad.net/percona-server/+bug/1028356) was referred as a duplicate. Hello Ronald,

we also open a bug #65831 (http://bugs.mysql.com/bug.php?id=65831) and it was mentioned as a duplicate of yours by Valeriy Kravchuk. And then it was crossed out..
When we tried to look at your bug, the only message displayed was “You do not have access to bug #65740″ (bug was mark as private)
Thank to Google cache, we were able to look into it and it looks in fact very similar to yours..
Why did your bug was marked as private but not ours ?
When we looked into the changes of 5.5.27, there is no mention of either your bug or ours ??
We also never received a notification that our bug was fixed, or was it ? Message from Hank Eskin is not clear as he mentioned your bug number but crossed out..
Note: an other similar bug listed in Percona (https://bugs.launchpad.net/percona-server/+bug/1028356) was referred as a duplicate.

]]> By: Clint Byrum http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15494 Clint Byrum Sat, 18 Aug 2012 06:46:00 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15494 Back when I was pushing hard for answers on Oracle's non-disclosure policies this was explained to me. Basically mysql engineers have their hands tied by the policy if it is deemed a security problem. A crash caused by non admin users is considered a privilege escalation. So, we will not be seeing test cases (since they are taylor made exploit scripts) nor will these bugs be made public again. :-[ I suspect they the desire not to disclose info about security bugs may also be delaying the bzr tree updates as well. Back when I was pushing hard for answers on Oracle’s non-disclosure policies this was explained to me. Basically mysql engineers have their hands tied by the policy if it is deemed a security problem. A crash caused by non admin users is considered a privilege escalation. So, we will not be seeing test cases (since they are taylor made exploit scripts) nor will these bugs be made public again. :-[ I suspect they the desire not to disclose info about security bugs may also be delaying the bzr tree updates as well.

]]> By: anonymous http://ronaldbradford.com/blog/when-is-a-crashing-mysql-bug-not-a-bug-2012-08-15/comment-page-1/#comment-15483 anonymous Fri, 17 Aug 2012 09:24:02 +0000 http://ronaldbradford.com/blog/?p=4100#comment-15483 If the crash is something that can be triggered by a non-admin user, it's likely to be treated as security by Oracle now, and any public info on it heavily obfuscated. It may re-surface months later via a Critical Patch Update in form of a CVE with no details allowing mapping it to an actual flaw. Though, you may ask in bug if it's treated as security and request information about what CVE is / will be assigned to it and make it public to help those who won't get it if they ask. http://www.attrition.org/pipermail/vim/2012-June/002562.html The above is likely to provide an explanation to the Sergei's query, as an attempt to avoid similar: http://www.h-online.com/security/news/item/Oracle-accidentally-release-MySQL-DoS-proof-of-concept-1526146.html If the crash is something that can be triggered by a non-admin user, it’s likely to be treated as security by Oracle now, and any public info on it heavily obfuscated. It may re-surface months later via a Critical Patch Update in form of a CVE with no details allowing mapping it to an actual flaw. Though, you may ask in bug if it’s treated as security and request information about what CVE is / will be assigned to it and make it public to help those who won’t get it if they ask.

http://www.attrition.org/pipermail/vim/2012-June/002562.html

The above is likely to provide an explanation to the Sergei’s query, as an attempt to avoid similar:

http://www.h-online.com/security/news/item/Oracle-accidentally-release-MySQL-DoS-proof-of-concept-1526146.html

]]>