3 ms·

> It was extremely irresponsible As a user and admin I disagree. Makes one appreciate what a masterful bit of lexical-engineering “Responsible” Disclosure is,

by Lammy 5mo ago

> It was extremely irresponsible As a user and admin I disagree. Makes one appreciate what a masterful bit of lexical-engineering “Responsible” Disclosure is, kinda like “Secure” (from me, not forme) Boot — “Responsible” Disclosure is 100% about reputation-management for the various corporation/foundation middleman entities sitting between me and my computer. Those groups don't care that my individual computer is vulnerable but about nobody being able to say “RHEL is vulnerable” or “Ubuntu is vulnerable”. The vulnerability exists for me either way, and I'd rather have the chance to know about it and minimize risk than to be surprised by the fix and hope nothing bad happened in that meantime. Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned.

eschaton 5mo ago
“The choice that maximizes potential damage isn’t irresponsible, because it means I can mitigate my own systems immediately.” That’s what you’re saying here.
- tptacek 5mo ago
  They're literally just restating the argument for full disclosure security. This is one of the oldest debates in information security.
  - 0x0 5mo ago
    The disclosure doesn't appear very "full". Looks like this was slipped into mainline linux among dozens of other mostly-irrelevant "CVEs" with nobody highlighting the fact that it is in fact dirty-cow-on-steroids. https://x.com/spendergrsec/status/2049566830771970483 https://x.com/spendergrsec/status/2049566830771970483 https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ https://lore.kernel.org/linux-cve-announce/2026042214-CVE-20... Or is everyone expected to upgrade and reboot every 48 hours for all eternity and just deal with potential regressions all the time? I think this reflects poorly on the original reporters. If you have a weaponized 700-byte universal local root exploit script ready to go, perhaps you should coordinate with major distros for patches to be available before unleashing it on the world. No matter how "veteran" you are.
    - tptacek 5mo ago
      Um, yes, everyone is expected to upgrade and reboot on a moment's notice. No policy or norm you come up with will change that. (This bug does not technically require a reboot to mitigate).
      - judemelancon 5mo ago
        I think I must misunderstand. Are you saying that you upgrade and reboot every production system that you administer to apply each commit to the kernel (branch it's using) essentially immediately? That doesn't make sense to me for a few reasons, but I struggle to find a different reading that applies "upgrade and reboot on a moment's notice" to the "slipped into mainline linux" scenario. Kindly help me to do so.
        tptacek 5mo ago
        No: your posture with respect to having to cycle servers is a super complicated subject and you address it both with process and with architecture (for instance: you can be blasé about things like CopyFail if you don't allow multitenant shared-kernel in your design in the first place). But no matter what process and design you have, if you're hosting sensitive workloads, you always have to be in a position where you can metabolize having to cycle your servers. It's a category error to talk about a disclosure event like this as something that would destabilize someone's fleet operations. The Linux kernel is fallible. So is the x64 architecture. You already have to be ready to lock things down and reboot (or mitigate) at a moment's notice. Remember: whatever else grumpy sysadmins have to say about this, Xint are the good guys. Contrast them with the bad guys, who have vulnerabilities just as bad as CopyFail, but aren't disclosing them at all --- you only find out about them when it's discovered they're actively be exploited. There's no patch at all. There isn't even a characterization of how they work, so that you could quickly see what to seccomp. That's the actual threat environment serious Linux shops operate in. LPEs are not rare.
        judemelancon 5mo ago
        Oh, I thought you meant "everyone" in a sense including actual human persons and the devices on their home network.
- deleted 5mo ago
  [deleted]
- akerl_ 5mo ago
  What the heck is up with people today. Using quotes around something where you’re actually doing a strawman paraphrase of another commenter you disagree with is bad form.
  - stavros 5mo ago
    It was clear that the original comment didn't say that, since we can see it right above. It was clear to me that the GP was using quotes as a way to use direct speech, not to imply that the GP literally said those words.
notsound 5mo ago
Those groups care about whether millions of computers are vulnerable, likely including your computer. If "immediate public disclosure" was done in all cases every vuln would be exploited and patches would be much lower quality. Shortening the disclosure timeline might be a good idea, 90 days is starting to feel long.
- Lammy 5mo ago
  Millions of computers are still vulnerable. Not-knowing about it doesn't mean the vuln isn't there :p
  - danparsonson 5mo ago
    But now millions more people know about how to exploit it who didn't before. I don't see why you're struggling with this.
    - Lammy 5mo ago
      You can't bully me into agreeing with you. Why are you struggling with that?
      - danparsonson 5mo ago
        That was my first comment in the thread. I'm not bullying you; if you don't want people to challenge your statements then you came to the wrong place ;-)
        Lammy 5mo ago
        You are engaging in bad faith when you act like I only have the belief I have because I don't understand yours yet. Don't comment if you can't respect somebody disagreeing with you.
  - AlessandroF6587 5mo ago
    Being vulnerable is not the important part. They have been vulnerable for years. The problem is the probability of being exploited. If everyone knows about the exploit details before a proper patch is available the number of exploited systems will skyrocket
BeetleB 5mo ago
So if I found a vulnerability that lets hackers withdraw withdraw all the money in your account without a trail on where the money went, you'd be fine with them disclosing it to the public at the same time as the bank learns about it? Even when there is no known use case of the attack (other than the security researcher's)? > The vulnerability exists for me either way, and I'd rather have the chance to know about it and minimize risk By the time you hear about it, the money could be gone because 1000 hackers heard about it from the researcher before you did. > than to be surprised by the fix and hope nothing bad happened in that meantime. Hope is not a good strategy here.
- Lammy 5mo ago
  Yep, I'd be fine with that. My bank has insurance, and my money would be returned.
  - ryan_n 5mo ago
    You're missing the point (not sure if you're just being dense on purpose...). If you're bank would just return the money then its not a good analogy. If someone gains root access to your machine, presumably they can do damage that can't be undone. In other words, to continue the bank analogy, they would take all your money and you would have no way of getting it back. Presumably, you would not be ok with this. And even if, for some weird reason, you were ok with that, 99.9% of all other people would not be ok with it.
    - Lammy 5mo ago
      [flagged]
    - stonogo 5mo ago
      Respectfully, I don't think they're missing the point. Banking, as an institution, has its flaws, but deposit insurance isn't one of them. These vulnerabilities exist whether or not they follow specific disclosure rituals, and systems should be deployed with defense-in-depth so that one privilege-escalation flaw is a recoverable event. Inventing tortured counterfactual analogies doesn't change the basic thrust of the poster's point: the account is insured, so getting drained by an attacker is not a fatal problem. Of course people should still take steps to prevent that from happening, but that doesn't mean prevention is (or should be) the only cure.
pphysch 5mo ago
The Venn diagram of mainstream distros and individual Linux users is virtually a circle. Ubuntu/RHEL is vulnerable and so are most Linux users by extension.
efortis 5mo ago
With immediate disclosure the provider can decide to shut down while it is fixed. Or to notify users and make it their decision. Or to be prepared with a diversified infra and switch over to a non-vulnerable path. e.g, BSDs are not affected by CopyFail
tomxor 5mo ago
> Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned. No, it's really not. High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place. Example: spectre/meltdowm mitigations. I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.

by Lammy 5mo ago

eschaton 5mo ago

“The choice that maximizes potential damage isn’t irresponsible, because it means I can mitigate my own systems immediately.” That’s what you’re saying here.

tptacek 5mo ago
They're literally just restating the argument for full disclosure security. This is one of the oldest debates in information security.
- 0x0 5mo ago
  The disclosure doesn't appear very "full". Looks like this was slipped into mainline linux among dozens of other mostly-irrelevant "CVEs" with nobody highlighting the fact that it is in fact dirty-cow-on-steroids. https://x.com/spendergrsec/status/2049566830771970483 https://x.com/spendergrsec/status/2049566830771970483 https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ https://lore.kernel.org/linux-cve-announce/2026042214-CVE-20... Or is everyone expected to upgrade and reboot every 48 hours for all eternity and just deal with potential regressions all the time? I think this reflects poorly on the original reporters. If you have a weaponized 700-byte universal local root exploit script ready to go, perhaps you should coordinate with major distros for patches to be available before unleashing it on the world. No matter how "veteran" you are.
  - tptacek 5mo ago
    Um, yes, everyone is expected to upgrade and reboot on a moment's notice. No policy or norm you come up with will change that. (This bug does not technically require a reboot to mitigate).
    - judemelancon 5mo ago
      I think I must misunderstand. Are you saying that you upgrade and reboot every production system that you administer to apply each commit to the kernel (branch it's using) essentially immediately? That doesn't make sense to me for a few reasons, but I struggle to find a different reading that applies "upgrade and reboot on a moment's notice" to the "slipped into mainline linux" scenario. Kindly help me to do so.
      - tptacek 5mo ago
        No: your posture with respect to having to cycle servers is a super complicated subject and you address it both with process and with architecture (for instance: you can be blasé about things like CopyFail if you don't allow multitenant shared-kernel in your design in the first place). But no matter what process and design you have, if you're hosting sensitive workloads, you always have to be in a position where you can metabolize having to cycle your servers. It's a category error to talk about a disclosure event like this as something that would destabilize someone's fleet operations. The Linux kernel is fallible. So is the x64 architecture. You already have to be ready to lock things down and reboot (or mitigate) at a moment's notice. Remember: whatever else grumpy sysadmins have to say about this, Xint are the good guys. Contrast them with the bad guys, who have vulnerabilities just as bad as CopyFail, but aren't disclosing them at all --- you only find out about them when it's discovered they're actively be exploited. There's no patch at all. There isn't even a characterization of how they work, so that you could quickly see what to seccomp. That's the actual threat environment serious Linux shops operate in. LPEs are not rare.
        judemelancon 5mo ago
        Oh, I thought you meant "everyone" in a sense including actual human persons and the devices on their home network.
deleted 5mo ago
[deleted]
akerl_ 5mo ago
What the heck is up with people today. Using quotes around something where you’re actually doing a strawman paraphrase of another commenter you disagree with is bad form.
- stavros 5mo ago
  It was clear that the original comment didn't say that, since we can see it right above. It was clear to me that the GP was using quotes as a way to use direct speech, not to imply that the GP literally said those words.

notsound 5mo ago

Those groups care about whether millions of computers are vulnerable, likely including your computer. If "immediate public disclosure" was done in all cases every vuln would be exploited and patches would be much lower quality. Shortening the disclosure timeline might be a good idea, 90 days is starting to feel long.

Lammy 5mo ago
Millions of computers are still vulnerable. Not-knowing about it doesn't mean the vuln isn't there :p
- danparsonson 5mo ago
  But now millions more people know about how to exploit it who didn't before. I don't see why you're struggling with this.
  - Lammy 5mo ago
    You can't bully me into agreeing with you. Why are you struggling with that?
    - danparsonson 5mo ago
      That was my first comment in the thread. I'm not bullying you; if you don't want people to challenge your statements then you came to the wrong place ;-)
      - Lammy 5mo ago
        You are engaging in bad faith when you act like I only have the belief I have because I don't understand yours yet. Don't comment if you can't respect somebody disagreeing with you.
- AlessandroF6587 5mo ago
  Being vulnerable is not the important part. They have been vulnerable for years. The problem is the probability of being exploited. If everyone knows about the exploit details before a proper patch is available the number of exploited systems will skyrocket

BeetleB 5mo ago

So if I found a vulnerability that lets hackers withdraw withdraw all the money in your account without a trail on where the money went, you'd be fine with them disclosing it to the public at the same time as the bank learns about it? Even when there is no known use case of the attack (other than the security researcher's)? > The vulnerability exists for me either way, and I'd rather have the chance to know about it and minimize risk By the time you hear about it, the money could be gone because 1000 hackers heard about it from the researcher before you did. > than to be surprised by the fix and hope nothing bad happened in that meantime. Hope is not a good strategy here.

Lammy 5mo ago
Yep, I'd be fine with that. My bank has insurance, and my money would be returned.
- ryan_n 5mo ago
  You're missing the point (not sure if you're just being dense on purpose...). If you're bank would just return the money then its not a good analogy. If someone gains root access to your machine, presumably they can do damage that can't be undone. In other words, to continue the bank analogy, they would take all your money and you would have no way of getting it back. Presumably, you would not be ok with this. And even if, for some weird reason, you were ok with that, 99.9% of all other people would not be ok with it.
  - Lammy 5mo ago
    [flagged]
  - stonogo 5mo ago
    Respectfully, I don't think they're missing the point. Banking, as an institution, has its flaws, but deposit insurance isn't one of them. These vulnerabilities exist whether or not they follow specific disclosure rituals, and systems should be deployed with defense-in-depth so that one privilege-escalation flaw is a recoverable event. Inventing tortured counterfactual analogies doesn't change the basic thrust of the poster's point: the account is insured, so getting drained by an attacker is not a fatal problem. Of course people should still take steps to prevent that from happening, but that doesn't mean prevention is (or should be) the only cure.

pphysch 5mo ago

The Venn diagram of mainstream distros and individual Linux users is virtually a circle. Ubuntu/RHEL is vulnerable and so are most Linux users by extension.

efortis 5mo ago

With immediate disclosure the provider can decide to shut down while it is fixed. Or to notify users and make it their decision. Or to be prepared with a diversified infra and switch over to a non-vulnerable path. e.g, BSDs are not affected by CopyFail

tomxor 5mo ago

> Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned. No, it's really not. High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place. Example: spectre/meltdowm mitigations. I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.