4 ms·
OpenSSL's "notification of an upcoming critical release" is public, not private. You do get to know that the vulnerability exists quickly, and you could choose
by cjbprime 3y ago
OpenSSL's "notification of an upcoming critical release" is public, not private.
You do get to know that the vulnerability exists quickly, and you could choose to stop using OpenSSL altogether (among other mitigations) once that email goes out.
- sidewndr46 3y agoif your system has already been compromised at the root level, it does not matter in the least bit
- Thorrez 3y agoWell if you assume everyone has already been exploited, disclosing quickly vs slowly won't prevent that. Also, if something is being actively exploited, usually there's no or very little embargo.