3 ms·
If I'm understanding correctly, Colin is unhappy about two things: (a) That Google didn't notify more operating systems about the vulnerability early. (b) Tha
by jonas21 9y ago
If I'm understanding correctly, Colin is unhappy about two things:
(a) That Google didn't notify more operating systems about the vulnerability early.
(b) That one OS community who Google did notify early broke the embargo, leading to exploits circulating prior to the embargo date.
But these are two sides of the same coin. The more groups of people you tell about the vulnerability early, the greater the risk that someone is going to break the embargo.
For a bug like this, it seems like no matter how you go about disclosing things, somebody is going to criticize you for it. Either you didn't tell enough people and the ones you didn't tell are mad. Or you told too many people, and someone breaks the embargo and everyone is mad. Or in this case, both!
- masklinn 9y ago> But these are two sides of the same coin. No, they are not. > The more groups of people you tell about the vulnerability early, the greater the risk that someone is going to break the embargo. Groups have different levels of trustability, disclosing to more trustable groups is less risky than disclosing to a single untrustable group.
- euyyn 9y agoColin's disappointment with the Linux community implies he did trust them. On hindsight it's easy to tell "well, you should have disclosed it to all the people that wouldn't leak it, and only those".