learning that some techbro fuckmuppet douchecanoe decided to leak the PHP exploit unilaterally to “protect everyone” (read: his customers) and fuck everyone else over and just argh
0 Boosts
0 Likes
@aurynn embargoes have NEVER worked
@feld they work fine when people aren’t assholes about it
@aurynn it's literally the trolly meme but you're choosing who gets to be saved from being hacked. We know for a fact that you can't keep things secret if too many people know about it, and we're way past the "too many people NEED to know about it" phase.
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past
@feld @aurynn My stance is, issue is reported to <insert secteam of project>, few developers know about it and work on a patch exclusively outside of other work on the project, patch is circulated around private distro lists to prepare packages on embargo release. Embargo max 7 days after patch is done, ideally 1-2 days.
@aurynn it has been a day yeah