3 ms·
The actual answer is in the thread: http://www.openwall.com/lists/oss-security/2015/07/23/19 http://www.openwall.com/lists/oss-security/2015/07/23/19 "That's
by davidgerard 11y ago
The actual answer is in the thread:
http://www.openwall.com/lists/oss-security/2015/07/23/19 http://www.openwall.com/lists/oss-security/2015/07/23/19
"That's how coordinated release dates work. Instead of trying to shame Qualys for not following your arbitrary views on what is and isn't "Responsible Disclosure", perhaps you should make sure Red Hat releases patches hours before the CRD, like Ubuntu does?"
The rest is the usual rehashed discussion on this topic.
- PhasmaFelis 11y agoImmediately followed by a Canonical employee saying that no, that's not true: "Ubuntu is actually very careful to not release anything ahead of CRD unless the CRD is broken elsewhere. Not saying we've never made a mistake, but as you can imagine it is quite annoying when a CRD is broken-- we certainly don't want to be the cause of that annoyance for others. :)"
- danielweber 11y ago> perhaps you should make sure Red Hat releases patches hours before the CRD, like Ubuntu does?" We could end up repasting the entire thread, but the very next comment is from Ubuntu denying that behavior. Releasing early is basically violating the embargo.
- cmurf 11y ago"There was absolutely nothing wrong with Qualys' timing. When the embargo ends, it ends." And then later some comments about people's panties being twisted, etc. which ends the thread. Reading the entire thing is worthwhile.