4 ms·

3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS pro

3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS projects get only notified on the disclosure date. Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors. Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them. The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.

user5994461 9y ago
The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.
- mimi89999 9y ago
  No as I would know about it by following security news?
  - user5994461 9y ago
    Are you so great that you know all the vulnerabilities all the time since the second of disclosure? Do you seriously expect the other billions of people on the planet to be that great too?
    - mimi89999 9y ago
      For most of them the day after, when I get a notification from my RSS app... No. I also don't expect them to choose device based on security. That is very bad as vendors won't care about patching their older devices (look at Android devices, home routers...) and vendors won't care about patching their flagship devices fast as they have the possibility to request very long embargos. Making compromises for those vendors and giving more time for security agencies and other bad actors to silently exploit the vulnerabilities (where FOSS projects would have made patches for users that care) is not the way to go. That philosophy actually makes everybody less safe.

user5994461 9y ago

The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.

mimi89999 9y ago
No as I would know about it by following security news?
- user5994461 9y ago
  Are you so great that you know all the vulnerabilities all the time since the second of disclosure? Do you seriously expect the other billions of people on the planet to be that great too?
  - mimi89999 9y ago
    For most of them the day after, when I get a notification from my RSS app... No. I also don't expect them to choose device based on security. That is very bad as vendors won't care about patching their older devices (look at Android devices, home routers...) and vendors won't care about patching their flagship devices fast as they have the possibility to request very long embargos. Making compromises for those vendors and giving more time for security agencies and other bad actors to silently exploit the vulnerabilities (where FOSS projects would have made patches for users that care) is not the way to go. That philosophy actually makes everybody less safe.