4 ms·
Read that again. We asked to commit without revealing details, he said yes, that's what happened. I guess he changed his mind about that after the fact, but nob
by tedunangst 9y ago
Read that again. We asked to commit without revealing details, he said yes, that's what happened. I guess he changed his mind about that after the fact, but nobody promised not to commit. We didn't "defect" from an embargo unilaterally.
- mtgx 9y agoSounds like a "we technically respected the embargo, just not in principle" sort of thing to me.
- dom0 9y agoThey agreed, but now they regret the decision and wouldn't make it again. To prevent themselves from doing so, they will not speak with OpenBSD until later in the process.
- gcp 9y agoWhat's the word for pressuring a person until they make a decision they immediately regret?
- deleted 9y ago[deleted]
- tedunangst 9y agoWe're not mind readers. If he says it's ok, we think it's ok. If other vendors have fucked up months long patch cycles, that's their deal, not ours.
- titzer 9y agoNow that it's more clear what role disclosure deadlines play in cooperating with security researchers, it probably makes more sense to just cooperate than point fingers.
- lifthrasiir 9y agoHe said it's ok this time, but won't be so in the future (pretty clear from the future action). So your decision is still subject to the criticism.
- ComputerGuru 9y agoWhat part of this commit description is "not revealing details"? https://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/027_net80211_replay.patch.sig https://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/027_n...
- tedunangst 9y agoAll of it? The paper describing the attack is longer than one sentence.
- askz 9y agoand this one ? ctrl+f replay https://www.tedunangst.com/flak/post/openbsd-changes-of-note-627 https://www.tedunangst.com/flak/post/openbsd-changes-of-note...
- titzer 9y agoPerhaps "defect" is the wrong word given the circumstances, but the result is the same. There's a good reason for the embargo: this all takes cooperation, as it's not a Nash equilibrium. I still agree with their decision not to include OpenBSD so early in further disclosures, given Theo's short-sighted statement.
- justonepost 9y agoWellll to be fair, I'm sure if the researcher said no, he wouldn't have committed.
- JumpCrisscross 9y ago> Perhaps "defect" is the wrong word It's precisely the correct word. Prisoner's dilemma are simple, mathematically. This was one. OpenBSD defected. The joke's on the security researcher, though, since this doesn't appear to have been their first time [1][2]. Robert Axelrod outlined, in his 1984 classic The Evolution of Cooperation [3] four requirements for a successful iterative prisoner's dilemma strategy. One is retaliating. Security researchers are letting OpenBSD play an iterating game as if it's an N=1, i.e. they're not retaliating. Given the community is playing "always cooperate," OpenBSD's best move is actually "always defect". [1] https://lwn.net/Articles/726585/ https://lwn.net/Articles/726585/ thank you 0x0 [a] [2] https://lwn.net/Articles/726580/ https://lwn.net/Articles/726580/ thank you 0x0 [a] [a] https://news.ycombinator.com/item?id=15481980 https://news.ycombinator.com/item?id=15481980 [1] https://en.wikipedia.org/wiki/The_Evolution_of_Cooperation https://en.wikipedia.org/wiki/The_Evolution_of_Cooperation
- fapjacks 9y agoNice analysis. It definitely seems to be the case.
- macawfish 9y agoSo does the simple mathematical treatment also include language like "the joke's on ____”? Or was that more of a philosophical interpretation of yours? Real life is messier than any model. https://www.quantamagazine.org/in-game-theory-no-clear-path-to-equilibrium-20170718/ https://www.quantamagazine.org/in-game-theory-no-clear-path-...
- jstanley 9y agoFrom what I've read, I don't see why everyone is giving you a hard time about this. It sounds like you did exactly what he agreed you could do, and then he changed his mind.