Comment by charcircuit
7 hours ago
And in the situation where they released a security patch 2 months ago, there would be a security patch before the bug was public.
7 hours ago
And in the situation where they released a security patch 2 months ago, there would be a security patch before the bug was public.
2 months ago there was no patch and no possibility of a very quick patch. Releasing details then would have been very bad.
If you mean they should have released the patch as soon as it was done, it's true that it would have been before the bug was public... for about five minutes. When a warning a day or two before patch release works, it lets admins prepare to patch immediately and/or shut down their servers before the release time.
Even with the leak, admins still had warning and it was better than an unwarned official patch drop. Which itself is better than an unwarned unofficial patch drop. Which itself is better than an unwarned drop of exploit details.
We are talking about a hypothetical where a patch is made <2 months. With AI agents, I can 100% assure you it would take a max of a few days to pat CB and test a mitigation. Not months.
If you are warning people to turn off their servers. You might as well give them a patch at the same time.
Let me try to split these concerns up:
1. The time it took to develop the patch doesn't matter. Nobody leaked anything during that period. It just needed to not be a huge length of time.
2. The time between the warning and the patch release is overall a good thing. In this case the secrecy failed halfway through and we only got a fraction of the benefit, but it was still better than "surprise and good luck with the imminent exploits, hope you weren't asleep!". If the secrecy hadn't failed it would have been much better.
3. There needs to be an official patch before releasing the details. Some random untrusted person publishing a patch has all the downsides of releasing the exploit but people can't safely install it fast.