2 ms·
Linux as a whole? I doubt it; but I can definitely imagine individual Linux distributions being contacted and asked to agree to strict terms (including "no pat
by cperciva 9y ago
Linux as a whole? I doubt it; but I can definitely imagine individual Linux distributions being contacted and asked to agree to strict terms (including "no patches get shared") before they are given details of future issues. Nobody wants to cut Linux out of things, so there's going to be an inclination to err on the side of "well maybe they didn't understand what the embargo meant...".
- tedunangst 9y agoI'm just following the narrative of anybody releasing a patch early gets the death penalty.
- bigiain 9y agoSomebody clearly wanted to cut BSD out of things... And succeeded. Also, while the Linux devs failing to honour the embargo ended up being a quite public and problematic thing, I _seriously_ doubt some of the other OS vendor dev teams didn't talk about the problem out of school - and I strongly suspect state-actors and blackhats have pipelines of information on security problems being worked on at Microsoft, Apple, Google, and many other big players. Overenthusiastic devs at local bars/cafes, boastful or bignoting devs online, or disgruntled employees/ex-employees, they are almost certainly targeted by both blackhat and state level actors. I'm pretty sure a security problem of this magnitude, requiring remediation work my this many different teams, work which took six months or more of planning and executing - could not _possibly_ have stayed completely unknown externally right up to the agreed embargo date. People just don't work that way.