Comment by creatonez
13 hours ago
> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.
Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.
On one hand you have the OP, who is self reflecting. On the other hand you have Dan Lorenc from Chainguard.
The thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.
It was a selfish, PR exercise. He could have done it quietly. He could have just made sure his customers got an emergency patch quietly. (those who are willing and capable to patch) It is not common that anyone in the public could use his source except for his customers. It is difficult to just build from his source and drop it to any operating system and setup and expect it to work (let alone compliance and other requirements). Instead, he expected the public to thank him like he was actually doing an act of good. Loss for words, to be honest.
it was easy to find if you had the tokens even without the chainguard patch
1 reply →
got a link
https://www.linkedin.com/feed/update/urn:li:activity:7518756...
Yeah, I don’t think OP did anything wrong. Someone in the chain violated embargo, but it wasn’t OP.
Well, this is an iterated prisoner’s dilemma.
I’d say maybe it’s more like a Roko’s Basilisk. He knew the potential existence of an embargo, but didn’t do anything to protect the embargo. So now that the embargo turned out to be real, he will be punished. Otherwise if he truly did not know an embargo could even exist, he could not be blamed.
There was no embargo. If there's an "embargo" but parties not subject to the embargo know about it... there's no embargo.
There's no such thing as Roko's Basilisk, only Pascal's Wager.
Except he won’t be punished, because nothing he did was legally wrong.
8 replies →
isn't "coordinated disclosure" exactly about keeping, embargoing, a secret?
yes but if it reached you without an embargo it's kinda already not kept
and you weren't coordinated with