3 ms·
OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Sugge
by brynet 9y ago
OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project.
You should read the rest of what you linked, and check the dates carefully.
- cthalupa 9y agoYes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
- tedunangst 9y agoDenying a request you haven't agreed to isn't breaking an agreement.
- cthalupa 9y agoIt's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.