learning that some techbro fuckmuppet douchecanoe decided to leak the PHP exploit unilaterally to “protect everyone” (read: his customers) and fuck everyone else over and just argh
0 Boosts
0 Likes
@aurynn embargoes have NEVER worked
@feld they work fine when people aren’t assholes about it
@aurynn it's literally the trolly meme but you're choosing who gets to be saved from being hacked. We know for a fact that you can't keep things secret if too many people know about it, and we're way past the "too many people NEED to know about it" phase.
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past
@feld @aurynn My stance is, issue is reported to <insert secteam of project>, few developers know about it and work on a patch exclusively outside of other work on the project, patch is circulated around private distro lists to prepare packages on embargo release. Embargo max 7 days after patch is done, ideally 1-2 days.
@phnt @aurynn I have a new one:
Initial announcement: "A no-auth RCE has been discovered. We do not have a fix yet. The details will be published in 8 hours. We do not know when the fix will be available yet. For every $20,000 donated to our project we will delay publishing the details another 2 hours. The better funding our project has the quicker we can remediate these incidents. Thank you for your time."
Initial announcement: "A no-auth RCE has been discovered. We do not have a fix yet. The details will be published in 8 hours. We do not know when the fix will be available yet. For every $20,000 donated to our project we will delay publishing the details another 2 hours. The better funding our project has the quicker we can remediate these incidents. Thank you for your time."
@aurynn it has been a day yeah