5 ms·
> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and compan
by rdtsc 9y ago
> FreeBSD Security Team was notified of the issue in late December
Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me?
They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not extend it to a few more projects?
Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded.
- loeg 9y agoFreeBSD secteam was only notified — at all — because Netflix (a big FreeBSD user) requested it of Intel. It was a big slap in the face to smaller communities by Intel.
- Bromskloss 9y agoHow did Netflix know about it?
- loeg 9y agoI guess, but do not have firsthand knowledge, that Intel disclosed directly to them as a large customer.
- bogomipz 9y ago>"Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me?" Indeed. There seems to be a security oligarchy now consisting of Google, FB, Apple, Amazon et al. and Intel.
- marcoperaza 9y agoThe more people you tell, the higher the chance of a leak. "Loose lips sink ships."
- kchoudhu 9y agoFreeBSD isn't two people in a garage, it's a foundational part of the internet developed by professionals who can be counted upon to do the right thing. Intel and Google don't have a leg to stand on: I'm super glad they found the bugs, but their disclosure has been nothing but a shitshow.
- user5994461 9y agoThey can't be counted on anything after they publicly announced they would ignore embargo.
- beefhash 9y agoThat was OpenBSD, not FreeBSD.
- deleted 9y ago[deleted]
- marcoperaza 9y agoI’m not arguing for or against anyone in particular getting notice. I’m just pointing out why they’d limit it in principle. You have the draw the line somewhere.
- user5994461 9y ago>>> Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded. AFAIK they all share the same brand name BSD and they are all closely affiliated.
- loeg 9y ago> AFAIK they all share the same brand name BSD and they are all closely affiliated. This is a gross falsehood. They all variously diverged from a parent project, called BSD, in the 90s. Since then they are wholly independent. Because of the common license and heritage, code sharing is often easy and legally unrestricted. But their leaders, policies, and philosophies are very distinct.
- andrewchambers 9y agoThat's like saying all GPL software are closely afficliated.