2 ms·
Did you read TFA? They have their disclosure timeline starting around July 2023.
by noitpmeder 3y ago
Did you read TFA? They have their disclosure timeline starting around July 2023.
- guerrilla 3y agoDid you read what postfix said? https://news.ycombinator.com/item?id=38729233 https://news.ycombinator.com/item?id=38729233
- remram 3y agoI wonder what "critical information" was missing. The gist of the exploit is a very short sentence. Not pointing fingers, but without looking at the actual email, the fault could lie on either side. "Missing critical information" is the excuse anyone would use after ignoring an important disclosure.
- SuperNinKenDo 3y agoYeah I did. As I said, maybe they thought this was going to reach the postfix crowd, but they name them in the article, indicate they're effected, and yet made no attempt to directpy inform the postfix guys? From the wording of postfix's announcement, it's possible they did disclose the vulnerability itself, but witheld some kind of important information, whatever that means. Or else we have to take for granted that the postfix crew are lying about it. Either way, why would you publish literally right before Christmas? People need time to check if they're affected and update or patch systems. At best it's highly inconsiderate, and it seems more negligent than inconsiderate.