I don’t get how that output showcases anything, unless he had run that against a known instance of forgejo so the owners of that instance could confirm that he actually executed code. But he’s only showing a text file, that’s like saying look I hacked super_secure_self_hosted_service:
python hack_it.py localhost:3000
Hacked!
For all we know chain_alpha.py is just a bunch of prints.
Also, even if it is real (which I don’t really doubt, but I have seen no proof) holding the information instead of properly disclosing it is just childish. It’s not a carrot methodology, it’s a stick one, and one without a carrot. This is the sort of thing you do to big companies with no morals, doing it to a small open source project is just wrong, they don’t have the manpower or money to redo the investigation you already did. Release a CVE, talk to the devs, and/or push a PR, but saying “I found a vulnerability but I won’t tell you about it” is just dumb.



That’s a stupid argument, and it’s more of a thing Americans say to try to convince themselves that their system makes sense. Taxes are also different in different EU countries, some companies have different prices on different countries because of it, while others prefer to advertise to the whole community as a single market. Regardless, the price they advertise is the price you pay, otherwise it’s called false advertising.