7 ms·

> Google discovered a problem and reported it to Intel, AMD, and ARM on June 1st. Did they then go around contacting all of the operating systems which would ne

> Google discovered a problem and reported it to Intel, AMD, and ARM on June 1st. Did they then go around contacting all of the operating systems which would need to work on fixes for this? Not even close. FreeBSD was notified the week before Christmas, over six months after the vulnerabilities were discovered. Absolutely shitty behavior by Google, AMD, Intel and ARM. Notifying the FreeBSD devs so late is a slap in the face to the FreeBSD community and makes the internet as a whole less safe.

dotancohen 9y ago
> Notifying the FreeBSD devs so late is a slap in the face to the FreeBSD community and makes the internet as a whole less safe. Absolutely. That is quite the proper response to FreeBSD leaking privileged information about vulnerabilities in the past.
- bigiain 9y ago
  Lucky it worked out so smoothly this time sharing with the Linux dev team...
  - tedunangst 9y ago
    Will be interesting to see if Linux is cut out of any future embargo.
    - cperciva 9y ago
      Linux as a whole? I doubt it; but I can definitely imagine individual Linux distributions being contacted and asked to agree to strict terms (including "no patches get shared") before they are given details of future issues. Nobody wants to cut Linux out of things, so there's going to be an inclination to err on the side of "well maybe they didn't understand what the embargo meant...".
      - tedunangst 9y ago
        I'm just following the narrative of anybody releasing a patch early gets the death penalty.
      - bigiain 9y ago
        Somebody clearly wanted to cut BSD out of things... And succeeded. Also, while the Linux devs failing to honour the embargo ended up being a quite public and problematic thing, I _seriously_ doubt some of the other OS vendor dev teams didn't talk about the problem out of school - and I strongly suspect state-actors and blackhats have pipelines of information on security problems being worked on at Microsoft, Apple, Google, and many other big players. Overenthusiastic devs at local bars/cafes, boastful or bignoting devs online, or disgruntled employees/ex-employees, they are almost certainly targeted by both blackhat and state level actors. I'm pretty sure a security problem of this magnitude, requiring remediation work my this many different teams, work which took six months or more of planning and executing - could not _possibly_ have stayed completely unknown externally right up to the agreed embargo date. People just don't work that way.
- SolarNet 9y ago
  I am now looking forward to the time a FreeBSD (or Linux) developer finds a complex-to-mitigate architectural bug, only pushes it to their kernel, and the world burns down around us because of this petty shit (including these posters, Google and hardware vendors in this). So thank you for that.
- 2trill2spill 9y ago
  > Absolutely. That is quite the proper response to FreeBSD leaking privileged information about vulnerabilities in the past. And what vulnerability leaks are you talking about?
  - cperciva 9y ago
    I'd like to know this too...
  - whyever 9y ago
    Maybe they are confusing FreeBSD with OpenBSD?
  - rincebrain 9y ago
    They might be mixing up Free and OpenBSD, and thinking of [1], since I can't find any obvious results for FBSD making that mistake. [1] - https://marc.info/?l=openbsd-misc&m=150815942414653&w=2 https://marc.info/?l=openbsd-misc&m=150815942414653&w=2
    - cperciva 9y ago
      If that's what it was, they were both mixing up FreeBSD and OpenBSD and had a time machine. OpenBSD has been clear in the past about not respecting embargoes, however. That's their right (Linus takes the same position) but I would completely understand people deciding to not notify OpenBSD as a result. But as far as I'm aware, FreeBSD has an exceptional track record when it comes to respecting vulnerability embargoes.
- ComputerGuru 9y ago
  Source, please? The only BSD I’m aware of that breaks embargoes is OpenBSD.
  - throwaway2048 9y ago
    This is false, OpenBSD agreed to the inital embargo on KRACK, the author wanted it extended, OpenBSD asked if they could publish a silent fix/patch, the author agreed, then later renegged, OpenBSD published it anyways, then the author got pissy. The idea that OpenBSD broke a bug embargo is misinformation.
    - ComputerGuru 9y ago
      No, it’s fact. We already went through this 3 months ago. https://news.ycombinator.com/item?id=15481946 https://news.ycombinator.com/item?id=15481946
      - throwaway2048 9y ago
        The post you linked confirmed what I just said...

dotancohen 9y ago

> Notifying the FreeBSD devs so late is a slap in the face to the FreeBSD community and makes the internet as a whole less safe. Absolutely. That is quite the proper response to FreeBSD leaking privileged information about vulnerabilities in the past.

bigiain 9y ago
Lucky it worked out so smoothly this time sharing with the Linux dev team...
- tedunangst 9y ago
  Will be interesting to see if Linux is cut out of any future embargo.
  - cperciva 9y ago
    Linux as a whole? I doubt it; but I can definitely imagine individual Linux distributions being contacted and asked to agree to strict terms (including "no patches get shared") before they are given details of future issues. Nobody wants to cut Linux out of things, so there's going to be an inclination to err on the side of "well maybe they didn't understand what the embargo meant...".
    - tedunangst 9y ago
      I'm just following the narrative of anybody releasing a patch early gets the death penalty.
    - bigiain 9y ago
      Somebody clearly wanted to cut BSD out of things... And succeeded. Also, while the Linux devs failing to honour the embargo ended up being a quite public and problematic thing, I _seriously_ doubt some of the other OS vendor dev teams didn't talk about the problem out of school - and I strongly suspect state-actors and blackhats have pipelines of information on security problems being worked on at Microsoft, Apple, Google, and many other big players. Overenthusiastic devs at local bars/cafes, boastful or bignoting devs online, or disgruntled employees/ex-employees, they are almost certainly targeted by both blackhat and state level actors. I'm pretty sure a security problem of this magnitude, requiring remediation work my this many different teams, work which took six months or more of planning and executing - could not _possibly_ have stayed completely unknown externally right up to the agreed embargo date. People just don't work that way.
SolarNet 9y ago
I am now looking forward to the time a FreeBSD (or Linux) developer finds a complex-to-mitigate architectural bug, only pushes it to their kernel, and the world burns down around us because of this petty shit (including these posters, Google and hardware vendors in this). So thank you for that.
2trill2spill 9y ago
> Absolutely. That is quite the proper response to FreeBSD leaking privileged information about vulnerabilities in the past. And what vulnerability leaks are you talking about?
- cperciva 9y ago
  I'd like to know this too...
- whyever 9y ago
  Maybe they are confusing FreeBSD with OpenBSD?
- rincebrain 9y ago
  They might be mixing up Free and OpenBSD, and thinking of [1], since I can't find any obvious results for FBSD making that mistake. [1] - https://marc.info/?l=openbsd-misc&m=150815942414653&w=2 https://marc.info/?l=openbsd-misc&m=150815942414653&w=2
  - cperciva 9y ago
    If that's what it was, they were both mixing up FreeBSD and OpenBSD and had a time machine. OpenBSD has been clear in the past about not respecting embargoes, however. That's their right (Linus takes the same position) but I would completely understand people deciding to not notify OpenBSD as a result. But as far as I'm aware, FreeBSD has an exceptional track record when it comes to respecting vulnerability embargoes.
ComputerGuru 9y ago
Source, please? The only BSD I’m aware of that breaks embargoes is OpenBSD.
- throwaway2048 9y ago
  This is false, OpenBSD agreed to the inital embargo on KRACK, the author wanted it extended, OpenBSD asked if they could publish a silent fix/patch, the author agreed, then later renegged, OpenBSD published it anyways, then the author got pissy. The idea that OpenBSD broke a bug embargo is misinformation.
  - ComputerGuru 9y ago
    No, it’s fact. We already went through this 3 months ago. https://news.ycombinator.com/item?id=15481946 https://news.ycombinator.com/item?id=15481946
    - throwaway2048 9y ago
      The post you linked confirmed what I just said...