3 ms·
7 days from disclosure to publishing a how-to guide to get root to the entire planet doesn't scream "responsible" disclosure to me.
by flumpcakes 5mo ago
7 days from disclosure to publishing a how-to guide to get root to the entire planet doesn't scream "responsible" disclosure to me.
- deleted 5mo ago[deleted]
- bawolff 5mo agoIts not the reporter's fault that other people broke the embargo.
- progval 5mo agoThey don't have to publish a working exploit as soon as the embargo is broken, though.
- john_strinlai 5mo agoanyone who will use the exploit maliciously will immediately and trivially be able to create a working exploit.
- mike_d 5mo agoWhy not? There has already been a working exploit floating around, at least now it comes from an authoritative source.
- throw0101c 5mo agoPerhaps, but if the exploit code is published folks can double-check that they implemented the mitigations properly. If there's no PoC, how can you really be sure?
- staticassertion 5mo agoAn exploit was already published.
- j16sdiz 5mo agoThe third party posted an exploit.
- firer 5mo agoMy immediate reaction was the same. But this is very similar to Copy Fail, and I'm assuming there was an assumption that others might also discover this soon as well. Hence the urgency. At least that's my charitable interpretation.
- lofaszvanitt 5mo agoWTF cares? Publish them without disclosure is the true way, otherwise noone would care about security and your data.