**:(){ :|: };:** @jgoguen@infosec.exchange · Jul 09, 2017, 01:57

**:(){ :|: };:** @jgoguen@infosec.exchange · Jul 09, 2017, 01:57

:(){ :|: };: @jgoguen@infosec.exchange

Remember how systemd starting as root if the username starts with a digit isn't a bug? Turns out they're technically right. It's not a bug.

It's a bug worthy of a CVE. CVE-2017-1000082, which had to be requested by third parties. Like, I suspect, every systemd CVE ever.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000082

**Vigdis** @Vigdis · 2017-07-09T13:56:16Z

Vigdis @Vigdis

@jgoguen imho not requesting a CVE is not really the problem. The problem is that they deny that's a bug, not even a security bug but a mere bug.

Jul 09, 2017, 13:56 · Tusky · 0 · 0

**:(){ :|: };:** @jgoguen@infosec.exchange · Jul 09, 2017, 17:04

**:(){ :|: };:** @jgoguen@infosec.exchange · Jul 09, 2017, 17:04

@Vigdis It smacks of serious lack of care for keeping end users (who care) and packagers and administrators informed of serious issues they're going to want to update to address. It just isn't acceptable for a project that wants to replace something as core as init, more so because they're trying to replace virtually every core important component.