4 ms·

> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in. It's 2026. We're more t

> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in. It's 2026. We're more than 30 years into the Linux ecosystem. I don't believe this bullshit for a moment. Given how trivially users can implement mitigation, distributions could have done _something_ to protect their users prior to publication date. A handful of messages is all that was required, not "every single downstream" - that is a straw man. The publication of a bug that trivially gains root on an incredible number of Linux installs that was discovered using an A.I. tool prior to any of the "downstreams" implementing a fix is intentional. I speculate the motivation is free promotion of the A.I. tool.

john_strinlai 5mo ago
>distributions could have done _something_ to protect their users prior to publication date. yeah, distributions could be following the kernel updates more closely and they would have been patched prior to publication. mainline was patched 30 days before publication. it is not the reporter's responsibility to babysit the linux distributions.
- paulnpace 5mo ago
  And here, with this comment, we see how the overall system functions: nobody actually cares what is going on with anything outside of themselves. It is a large group of individualized nihilists with total disregard to everyone, and you will provide lengthy justifications to maintain this system, as is.
  - tptacek 5mo ago
    It is a large group of people with their own incentives, and you're surprised they aren't self-organizing (or accepting outside pressure) to align with your own incentives.
  - akerl_ 5mo ago
    Ah yes, all those nihilists spending their spare time volunteering as developers and maintainers of open source projects.
  - john_strinlai 5mo ago
    >nobody actually cares what is going on with anything outside of themselves. "not caring" would be not disclosing the vulnerability at all, and instead selling it to the highest bidder on one of the private markets which, given the ridiculous and undeserved lashings the researchers are receiving from people completely outside of the security ecosystem, i would not be surprised if they moved in that direction. they would certainly make more money.

john_strinlai 5mo ago

>distributions could have done _something_ to protect their users prior to publication date. yeah, distributions could be following the kernel updates more closely and they would have been patched prior to publication. mainline was patched 30 days before publication. it is not the reporter's responsibility to babysit the linux distributions.

paulnpace 5mo ago
And here, with this comment, we see how the overall system functions: nobody actually cares what is going on with anything outside of themselves. It is a large group of individualized nihilists with total disregard to everyone, and you will provide lengthy justifications to maintain this system, as is.
- tptacek 5mo ago
  It is a large group of people with their own incentives, and you're surprised they aren't self-organizing (or accepting outside pressure) to align with your own incentives.
- akerl_ 5mo ago
  Ah yes, all those nihilists spending their spare time volunteering as developers and maintainers of open source projects.
- john_strinlai 5mo ago
  >nobody actually cares what is going on with anything outside of themselves. "not caring" would be not disclosing the vulnerability at all, and instead selling it to the highest bidder on one of the private markets which, given the ridiculous and undeserved lashings the researchers are receiving from people completely outside of the security ecosystem, i would not be surprised if they moved in that direction. they would certainly make more money.