Protip: academic board observed secret and so did vendors. The OpenBSD patch went unnoticed. It was the Infosec community that screwed up.https://twitter.com/marcan42/status/919972354947796993 …
-
Not true. And typical, since it does not do any harm, makes it reasonable and not “irresponsible”.
It does harm - it adds 2+ months to the vulnerability window. At the very least you should be sending drafts of the paper out to vendors.
-
-
Finishing the paper, sending it in for review, *waiting 2 damn months* then casually starting to notify vendors is utterly ridiculous.
-
The two months do not add to nothing. You should try reading the ISO standards and some prior debate on disclosure.
- Show replies
New conversation -
-
-
Nope, it doesn’t. Academic review of these papers happens under secrecy (this was NOT leaked in the academic review process).
-
That assumes you're the only one who knows about the bug so far. That is an irresponsible thing to assume.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.