6 ms·
It's not clear to me what the best approach is here. The wider the circle of those who know, the more likely it is that there will eventually be a leak. Three c
by discoursism 9y ago
It's not clear to me what the best approach is here. The wider the circle of those who know, the more likely it is that there will eventually be a leak. Three can keep a secret if two are dead and all that.
- TrueSelfDao 9y agoIf I'm not mistaken, this was the same approach taken when dealing with heartbleed.
- chinathrow 9y agoThere was a leak. Typing this from Ubuntu - still no updated kernels yet.
- lathiat 9y agoShould be coming on/before Tuesday: https://insights.ubuntu.com/2018/01/04/ubuntu-updates-for-the-meltdown-spectre-vulnerabilities/ https://insights.ubuntu.com/2018/01/04/ubuntu-updates-for-th...
- discoursism 9y agoIt wasn't so much a leak as someone putting two and two together and the cat getting out of the bag. Anyway, this is a nonsense argument in the context of the thread. They tried to keep things quiet by limiting the size of the circle, among other things. Their attempts at secrecy did not entirely succeed, although they made it 90% of the way to the embargo date without things coming out. Their inability to make it 100% of the way does not inform us at all about whether they should indeed have limited the circle of those who knew.
- hugo0384729109 9y agoExactly. I assume if one of the smaller providers like Linode found an internal vulnerability that they thought was a big security risk to have widely know and had 3 giant customers and a large number of smaller customers, they’d work directly with the giant customers in advance in the same way.
- gm-conspiracy 9y agoI am resisting the urge to make a Linode and ColdFusion joke.
- threeseed 9y agoI was a Linode customer back when there was a security incident where everyone found out on Reddit before the company bothered to tell anyone. And then once news did come out they never said (a) what happened or (b) what steps were taken to prevent it happening again. I am very reluctant now to trust the little guys with anything remotely mission critical.
- deleted 9y ago[deleted]
- sillysaurus3 9y agoThis proverb is mostly not true. I've worked in high-secrecy areas and everybody keeps their mouth shut because they're terrified of the consequences to their career. Three can keep a secret if two are bound by an NDA is closer.
- discoursism 9y agoI think in a tightly bound organization where all incentives are well aligned, that can be true.