3 ms·
It's kind of unsettling to know there is a known vulnerability (at least known to some) out there and is going to stay unpatched for a couple of days. On the ot
by krylon 11y ago
It's kind of unsettling to know there is a known vulnerability (at least known to some) out there and is going to stay unpatched for a couple of days. On the other hand, it is kind of nice to be able to brace for it mentally.
Does anybody know why the update is announced a couple of days in advance? Are e.g. maintainers of corresponding packages in Linux distros or *BSD given access to the code ahead of time so they can build new packages?
- hannob 11y ago>Does anybody know why the update is announced a couple of days in advance? For server operators to be prepared. (And I would prefer if they would narrow the timescales more for that.) >Are e.g. maintainers of corresponding packages in Linux distros or *BSD given access to the code ahead of time so they can build new packages? Yes, but that doesn't require a public announcement.
- krylon 11y agoThanks for clearing that up!
- riffraff 11y agopresumably, the newly released code might teach malicious users what vulnerabilities are there, which in turn makes everyone who didn't patch quickly vulnerable. By announcing in advance what is going to happen, people can be ready to update as soon as the patch is available.
- grantcox 11y agoThe early announcement allows our sysadmins to plan to work during those hours, and for the rest of our org to know that we'll have rolling infrastructure downtime, and that isn't the best time to plan a new feature launch etc.