2 ms·
> OpenBSD has a reputation for not respecting embargoes, even as recently as the KRACK wifi thing last year. Stop spreading this FUD. OpenBSD developers were a
by akerro 9y ago
> OpenBSD has a reputation for not respecting embargoes, even as recently as the KRACK wifi thing last year.
Stop spreading this FUD. OpenBSD developers were allowed to make the patch silently, they contacted the KRACK researcher and he agreed to this. HE CHANGED HIS MIND LATER, after the patch went it and he started blaming OBSD and spreading bullshit.
>Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability.
https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd
- cthalupa 9y agoThere's a whole other thread covering this. He asked them to respect the extension. They pushed back against it. Rather than making a big fight about it, he shrugged and went "Well, fine, whatever" It was obviously not an amenable thing to him, because he's specifically not even going to give them the same level of warning with the understanding they must respect the full embargo period, because right after the bit you quoted, he says: >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If it was just him going "Yeah dudes go for it it's cool everyone else will have to wait out the extended embargo but you can just release the patch immediately!" he wouldn't be punishing OpenBSD for it.