3 ms·
The only people you can really give advance notice to are those who will keep it secret until the embargo is lifted. That is basically attackers (TAO), service
by rdl 13y ago
The only people you can really give advance notice to are those who will keep it secret until the embargo is lifted. That is basically attackers (TAO), service providers (like Cloudflare and Akamai), and very small software development teams who don't release code to public repositories.
I'm sure glad they gave CF advance notice vs TAO (presumably). I'd prefer if it just dropped with zero notice for anyone, although if a security company wants to provide priority notice about vulnerabilities it discovers to people who pay the company in advance, good for them.
- dfc 13y agoTAO = NSA Tailored Access Operations https://en.wikipedia.org/wiki/Tailored_Access_Operations https://en.wikipedia.org/wiki/Tailored_Access_Operations
- mentat 13y agoI fail to grasp on Cloudflare and Akamai are "service providers" and Amazon Web Services is not.
- indolering 13y agoThis is just speculation, but Amazon isn't known for playing very nice in the open-source community. Maybe they lacked the personal relationships required for someone in the know to trust them. OpenSSL, CloudFlare, Google … those are all open-source shops.