3 ms·
It's not "in the wild." OpenBSD is making the gamble that either a) they can pressure the adults doing coordinated disclosure to stop doing that via their exce
by danielweber 12y ago
It's not "in the wild."
OpenBSD is making the gamble that either a) they can pressure the adults doing coordinated disclosure to stop doing that via their excellent people skills, or b) that they are so awesome that they can find the problems before everyone else.
NB: I love OpenBSD from a security POV, but that doesn't mean what the leaders of the project do is always correct for security.
- detaro 12y agoWe mostly don't know if it is already "in the wild" or not, if it will be found independently during the embargo period, if it will leak out of one of the organizations "in the know", ... Didn't people find traces of hearthbleed attacks that happened months before it was published? There are good arguments for very short embargo periods, especially if you mostly care about the security of your users. (of course, in a perfect world every vendor would be willing/able to release patches after 24 h or so, and it wouldn't matter, but we don't have one of those...)
- davidgerard 12y agoIt's hardly just OpenBSD. Read Al Viro's comment to http://lwn.net/Articles/601958/ http://lwn.net/Articles/601958/ He notes that Linus left the list due to the same policy.