4 ms·
> so why no responsible disclosure? Presumably because the main danger here comes from state-level adversaries who already know and actively exploit the issue,
by lazyjones 11y ago
> so why no responsible disclosure?
Presumably because the main danger here comes from state-level adversaries who already know and actively exploit the issue, not script kiddies who might get funny ideas after reading the announcement. So the sooner it is published and people can start fixing their servers and clients, the less damage is done.
- schoen 11y agoYeah, a big part of the risk here is that someone might spend a couple million dollars and have a form of this capability up and running within a couple of months (and that governments may have done that by around 2010). If you want to improve your crypto, you can probably roll out a better configuration much faster than new adversaries can get these capabilities up and running. (Except for this Java compatibility problem, maybe.)