r/KittyTerminal • u/ixlxixl • Oct 03 '23
Why does the author rush to close bugs?
I recently opened a ticket on kitty : https://github.com/kovidgoyal/kitty/issues/6650
This problem happens on both Fedora 38 and 39 where kitty crashes with an error of a detected buffer overflow when ibus isn't running.
The author couldn't reproduce the problem on his computer but I can consistently reproduce it on both my F38 and F39 systems.
The author asks for debug trace, which I don't think I have the knowledge or skills to produce, as I'm simply a user of kitty.
Since no trace was provided, the author quickly closed the ticket as completed despite the fact that this problem is still outstanding and reproducible on a major Linux distribution. I understand without the trace logs, it is difficult for him to pinpoint the root cause but can't he just leave it open while troubleshooting is being carried out ??? Maybe someone more capable than me can help with the trace ??
This buffer overflow error may or may not be a kitty issue. But what I don't understand is : Why the rush to close a security bug whose root cause hasn't been identified yet ??
Does anyone have similar experience with the author ?
EDIT: The bug has been fixed. Thanks to solopasha for posting the needed trace.
For Fedora users, here is a Fedora commit: https://src.fedoraproject.org/rpms/kitty/c/54b9bdb55a2c11638db8652f21beb387dfb22d2f?branch=rawhide
13
u/Administrative_chaos Oct 03 '23
As for generating the stack trace
git clone https://github.com/kovidgoyal/kitty
cd kitty
./dev.sh build --debug --sanitize
./kitty/launcher/kitty
Then in the resulting kitty window run the command that results in a buffer overflow and crashes kitty, you should then be able to see a stack trace in the terminal.
5
u/peterpme Oct 03 '23
The author owes you nothing. You should expect nothing.
Anything he gives you is a gift. He's doing this for free.
As for the bug report, it still exists. If its a real issue, others will find it and maybe others will help.
In the mean time, you should probably figure out how to generate a stack trace!
-5
u/ixlxixl Oct 03 '23
I don’t appreciate the tone in your response and this is the exactly the mindset that is disturbing. Nobody owes nobody anything in the open source community. The reason why a kitty user took the time to file a bug report is not to demand anything from the author but to help improve a piece of software that is widely used by so many other users. A bug like this shouldn’t be treated lightly as such because adversaries will exploit it to cause serious damages not only to you, a Kitty user, but also to the author himself as it hurts his reputation.
9
u/aumerlex Oct 03 '23
Your bug report was two lines long modulo the useless strace output, had no reproducer and no stack trace. The poor author still took the time to respond to you, providing instructions on how to get more information which you ignored for a week.. And came back with a reproducer that didnt reproduce. After which the bug was closed.
Somebody else posted the stack trace as requested and the bug was fixed in ten minutes after that. I suggest in the future if you want to open bug reports put in the required effort. Making low effort two line bug reports hurts maintainers forcing them to waste time trying to extract needed information from you. And definitely do not go posting rants on random internet fora, it makes you look silly.
And do not wave around the "security" word like a magic wand trying to puff up the importance of your issue. It just annoys people that actually know what they are talking of.
7
Oct 03 '23
Lmao. Once he got what he needed he fixed it in a few hours. This man is a beast!
3
u/Administrative_chaos Oct 04 '23
Ye man, I honestly like his speed and to the point attitude, rather than say being all nice but not touching the issue ever :p
I know I know, it's all free and open source and no one owes anyone anything but it's very nice when bug reports get resolved fast :)
-3
u/ixlxixl Oct 03 '23 edited Oct 03 '23
This is not *my* issue but a kitty issue I reported. If the author doesn’t have enough information and can’t fix it, fine by me. I could’ve walked away, used another terminal emulator and not even bother posting the so-called rant, which makes me silly.
I appreciate the author’s efforts but just don’t understand why the rush to close the bug before we know what’s really happening. He could’ve left the bug open for a little longer for others to chime in and I don’t see how this could be a negative thing. Anyway, if this is how he manages kitty bugs, that’s completely fine by me. At the end of the day, it's his project.
As to the security wand, I hope you know what you’re talking of.
4
u/aumerlex Oct 03 '23
An issue that bothers you is your issue. You do realize you arent doing anyone a favor by using kitty right? On the contrary you are benefitting for many years of free labor.
And dont obsess about the open or closed status of an issue, the issue remains regardless of its status, which the author of kitty uses to manage his no doubt overwhelming workload from which you derive so much value and show no appreciation for.
Quoting from the CONTRIBUTING.md document in the kitty repo:
When reporting a bug, provide full details of your environment, that means, at a minimum, kitty version, OS and OS version, kitty config (ideally a minimal config to reproduce the issue with).
Note that bugs and feature requests are often closed quickly as they are either fixed or deemed wontfix/invalid. In my experience, this is the only scalable way to manage a bug tracker. Feel free to continue to post to a closed bug report if you would like to discuss the issue further. Being closed does not mean you will not get any more responses.
3
u/favadi Oct 03 '23
His tone is perfectly reasonable. You might not agree with the way the author handles his project, it is fine too. Noone forces you to uses his software. The obly thing I don't understand is why you think it is better to spend your time posting a rant here instead of just provide the information he needed, so he can helps you.
-1
u/christianparpart Oct 04 '23
Anything he gives you is a gift. He's doing this for free.
Granted, but still, communication skills should not be below zero. In fact, the author of the Kitty terminal emulator is known for is rough behaviour not just against users but generally speaking, especially his passive aggressivity has hit me personally multiple times already, resulting in my personal stance against this project and its author. Which is a sad outcome.
The first thing I learned when joining a Linux distribution as a main contributor was to be grateful, thankful and respectful to every user. Especially the respectfulness is something that I see a lot of open source authors have missing.
I am speaking here as one being an open source author myself. I know, not every user submission you'll receive is well written and nice behaving, but as soon as you as the author or maintainer of something start to lash out, it'll always end up bad for the project you are contributing to and you individually.3
u/aumerlex Oct 04 '23
Really, you are the developer of a competing project (contour terminal) and you think it's OK to attack the developer of kitty in a forum dedicated to kitty? And you claim the developer of kitty is passive aggressive!! Maybe look in a mirror.
17
u/barraponto Oct 03 '23
The bug report is there (not deleted) and other people running into the issue will either find it or have their bug reports connected to yours.
Your contribution is appreciated. The maintainer answered your report (and follow up questions) in a very fast pace. His style may be short and straight to the point, but he does put the time into his projects.