4 ms·
They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.
by kasey_junk 6mo ago
They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.
- OvervCW 6mo agoYou cannot deny that telling the entire world about this vulnerability before it is patched won't cause a lot of abuse that would not have happened otherwise.
- akerl_ 6mo agoWhy not?
- kasey_junk 6mo agoI do deny that, mostly because we’ve entered the time of automated vulnerability detection and abuse. A human need not be in the loop at all anymore. But, even if I agreed with you, how do you propose they tell the patchers this that doesn’t tell the whole world?
- marshray 6mo agoAFAICT it was a Linux kernel maintainer who first "told the entire world about the vulnerability" on 2026-03-31: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryp... The CVE was officially announced on 2026-04-22: https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ https://lore.kernel.org/linux-cve-announce/2026042214-CVE-20... Theori were simply the last team to publicly disclose the vulnerability on 2026-04-29, 37 days after reporting it to the vendor. They were simply more effective at communicating it, and they told you that you were vulnerable. That's why you're mad at them instead of the people who put the bug there in the first place, didn't bring its severity to your attention, and silently sat on the patch.
- nextlevelwizard 6mo agoSo why not just tell immediately on discovery? After all every flaw exists already so what’s the difference?
- kasey_junk 6mo agoThat would have been fine too?