Protip: academic board observed secret and so did vendors. The OpenBSD patch went unnoticed. It was the Infosec community that screwed up.https://twitter.com/marcan42/status/919972354947796993 …
-
That assumes you're the only one who knows about the bug so far. That is an irresponsible thing to assume.
In this day and age people buy and sell vulns and the NSAs of the world have an arsenal of 0days and holding onto bugs is just Wrong™.
-
-
You seem to assume this info may get in the hands of anybody, but the set of reviewers is public and the association between paper and reviewer is not lost after submission. If exploit leaks the one responsible can be singled out. That’s a significant control mechanism
-
That’s also the same reason why responsible disclosure indirectly discourages double-trading vulns to the vendor as well as in the markets, for example.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.