Hector Martin

If you're coordinating disclosure, you're supposed to *understand* the interactions between different bits of software, and encourage cross-vendor collaboration to make the impact known and figure out how mitigations are deployed and interact. The researchers totally botched this

The fact that *I* needed to go around asking some people for info and digging for commits and bugs and mailing list threads to figure out how the fuck this all works and that nobody else did so tells me this disclosure was a massive clusterfuck, and that's on the researchers.

The researchers notified every single relevant project. What precisely are you asking them to do differently? They gave months of notice on a handful of bugs with a SIMPLE PATCH.

*Follow up* on that notice to actually find out what got patched where. Because when I asked *them* they still claimed Thunderbird was vulnerable (to the PGP issue, in context) which turned out to be total bullshit.

Thunderbird kept their ticket private. I don’t think the researchers (and the CERT) were told the status.

So.... ask? Or, you know, just *try* the damn exploit on the current release (like I did) before coordinating a panic-inducing media reaction with the EFF?

The panic inducing media reaction that led to the advice to “temporarily disable PGP clients”, some of which turned out to be still vulnerable (albeit on unlikely cipher choices)? Hardly seems a big deal. The pro-PGP community has invented an overreaction where none exists.

Then they invented a disclosure problem where none existed.