4 ms·

Seem a bit inflexible from Project Zero, given that Github has already disclosed it anyway. Why didnt they disclose earlier even? Seems like program part could

• Twirrim 6y ago
  > 2020-10-30 Due to no response and the deadline closing in, Project Zero reaches out to other informal Github contacts. The response is that the issue is considered fixed and that we are clear to go public on 2020-11-02 as planned. > 2020-11-01 Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future. Suggests to me that GitHub has no clue whether it's resolved or not. Project Zero were following GitHub's lead. Asked them if the problem was resolved or not, didn't get anything, had to reach out to internal contacts, and then got a conflicting message saying "NO WAIT!"
  • kerng 6y ago
    To be fair thats a one sided view of the issue. Will be interesting to see Githubs take.
    • kelnos 6y ago
      I think it kinda doesn't matter. Project Zero had already given them an extra 14 days; GH should have made better use of it. If you're constantly making exceptions to your rules for people, the rules end up being more flimsy and less respected. Regardless, GH had already disclosed this a month before, so their desire for 2 more days was unnecessary: the cat was already out of the bag, through their own actions.