3 ms·
What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody
by busterarm 8y ago
What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait.
You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
- eridius 8y agoI'm not sure what your point is. If you're aware that an embargo exists, then you're aware that patches are already being worked on. Telling the world that a vulnerability exists in a particular product, without knowing the details, doesn't cause patches to materialize that wouldn't have otherwise (remember, the patches are already in progress), all it does is enable attackers to concentrate on that product. And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
- busterarm 8y agoThe patches are already in progress for folks that are part of the embargo. Not anyone else. BSDs, Linux distros that aren't RHEL or Debian based, and niche OS almost always get left out in the cold.