4 ms·
Which is why I love OpenBSD. You're literally complaining that OpenBSD closes security holes too quickly! As a user I want that. We need to be honest that emba
by AndyMcConachie 8y ago
Which is why I love OpenBSD. You're literally complaining that OpenBSD closes security holes too quickly! As a user I want that.
We need to be honest that embargoes serve a couple different purposes. One might be to prevent the leaking of information to malicious actors, and another is to protect vendors and HW manufacturers from embarrassment. As a user I don't care about the latter. Also, as someone concerned with the state of the world I dislike secret clubs, and I fear the reliance on secret clubs provides a false sense of secretivenss. Secrets leak.
If the bug is important enough to warrant an embargo it needs to be fixed ASAP. A month is too long to run with an important vuln in running code. It's always going to be a balance, and as a user not involved in any secret security clubs I want those bugs fixed and in the public space as quickly as reasonably possible.
- vertex-four 8y agoOn the other hand, by publishing the vulnerability, you’re making people running all those other systems more vulnerable. The point of the embargo process is collective security, rather than just the security of your own users. One day, your project of choice won’t be able to fix a vulnerability as quickly as another - and you’ll be left in the lurch then, without an embargo.