3 ms·

Why do you think there is a story here? Witholding the nitty gritty details until your conference talk is not that unusual.

• saagarjha 3y ago
  Well for one usually library maintainers don't learn about bugs in their software from the abstracts of security talks
  • kzrdude 3y ago
    There's a CVE for it - CVE-2024-2961 - and fixed glibc versions have already been released (and reached Ubuntu LTS for one thing) so I think it's fine.
  • bawolff 3y ago
    Responsible disclosure generally means you tell the maintainers first before doing your splashy talk. Which appears to be what happened here since there is a cve, and we know mostly what was fixed. The talk would probably just go into nitty gritty details about how it was found and how its exploitable, stuff a skilled researcher would already be able to figure out based on what has already been publicly released.
    • saagarjha 3y ago
      idk I read that as "I found out about this from the abstract". Not sure if it was shared in advance
      • bawolff 3y ago
        If people found out about this from an abstract, the fixed version wouldn't have already been pushed to distros, cves issued, etc by the time it was public. People would also be a lot more angsty about it. Nothing about this suggests that it wasn't first privately disclosed to the glibc maintainers or that anything else improper happened.