Yes but they obtained this information based on the one-sided courtesy of another party, under a scheme that tried to get as many people to safeguard together.
If the first party to receive this information says, "Wow, of course I must act on this, because customers are on the line," then it makes sense to simply choose who you tell more carefully or not at all.
If you saw customer data was being compromised; financial data, government data, electronic patient records etc, and you had the fix. Would you do nothing?
The alternative isn't "doing nothing". It's raising the issue in the coordination group so that everyone can collectively decide on a new timeline if necessary, and you aren't leaving everyone else hanging out to dry.
Publishing a patch beforehand potentially multiplies the impact. Now the actual bug(s) can be diffed from the source. Whereas existing PoCs (after verifying whether it even works), obfuscated at least a bit about the details. It is not so clear what is the best approach.
Yesterday the actual bugs plus many more (though less critical) were discovered by the people pointing their LLMs at it. I am confident no new bugs will be found by looking at binary diffs compared to what was already surfaced.
what possible reading of "I made the call to get these out early when exploits hit in the wild" contorts into "these exploits hit in the wild after i made the call to get these out early" with flipped causality?
If you want to 'adopt' a new reality, you talk to all parties, and everyone moves up the release. That's how agreements and trust work. If you don't do so? No one will trust you ever again.
It seems like you don't agree with coordinated releases as a standard. That's fine, but irrelevant here. If you agree to coordinate, so that you can get inside info on security updates and be prepared, and then break that agreement, you're not trustworthy. No hand wavy reasons will change this fact.
I don't know many who want to deal with untrustworthy people.
Yes but they obtained this information based on the one-sided courtesy of another party, under a scheme that tried to get as many people to safeguard together.
If the first party to receive this information says, "Wow, of course I must act on this, because customers are on the line," then it makes sense to simply choose who you tell more carefully or not at all.
If you saw customer data was being compromised; financial data, government data, electronic patient records etc, and you had the fix. Would you do nothing?
The alternative isn't "doing nothing". It's raising the issue in the coordination group so that everyone can collectively decide on a new timeline if necessary, and you aren't leaving everyone else hanging out to dry.
Publishing a patch beforehand potentially multiplies the impact. Now the actual bug(s) can be diffed from the source. Whereas existing PoCs (after verifying whether it even works), obfuscated at least a bit about the details. It is not so clear what is the best approach.
Yesterday the actual bugs plus many more (though less critical) were discovered by the people pointing their LLMs at it. I am confident no new bugs will be found by looking at binary diffs compared to what was already surfaced.
Was the exploit made, from reverse-engineering, this early release? Because that is how I'd do it.
what possible reading of "I made the call to get these out early when exploits hit in the wild" contorts into "these exploits hit in the wild after i made the call to get these out early" with flipped causality?
The reading that chainguard have said that before when it was not the case.
Why would you implicitly take them at their word?
2 replies →
No.
If you want to 'adopt' a new reality, you talk to all parties, and everyone moves up the release. That's how agreements and trust work. If you don't do so? No one will trust you ever again.
And?
You won't be at the table next time.
[flagged]
It seems like you don't agree with coordinated releases as a standard. That's fine, but irrelevant here. If you agree to coordinate, so that you can get inside info on security updates and be prepared, and then break that agreement, you're not trustworthy. No hand wavy reasons will change this fact.
I don't know many who want to deal with untrustworthy people.
2 replies →