[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2e6c7172-fedc-41c7-8407-e9b1ee39adac@oracle.com>
Date: Sat, 11 Apr 2026 19:21:23 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Collin Funk <collin.funk1@...il.com>
Subject: Re: GNU tar: listing/extraction desynchronization
allows hidden file injection
On 4/11/26 11:41, Collin Funk wrote:
> Alan Coopersmith <alan.coopersmith@...cle.com> writes:
>
> Not directly related to the issues in GNU tar, but one of the reports
> you shared [1]. See the following text:
>
>> I am happy to coordinate on a disclosure timeline. Please let me know
>> if you need additional information or testing.
>
> This is one of many examples I have seen lately of people writing as if
> they were sending private messages on a public list. I assume it is a
> common LLM hallucination?
Yes, we saw it happen on the freetype mailing list as well recently - there it
was suggested that new people are unfamiliar with the concept of a publicly
subscribable/archived mailing list, as they all use web forums / tools instead
of email for collaboration now:
https://lists.nongnu.org/archive/html/freetype-devel/2026-03/msg00020.html
and the freetype.org contacts page was updated to try to clarify where to send
vulnerability reports privately.
I wouldn't be surprised to find out many LLMs don't understand the lists
they're mailing have public archives/subscriptions either.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
