Hopefully the industry will learn something about how withholding fixes to known vulnerabilities is, in fact, bad policy.

▲

my-huge-pony 3 hours ago | parent | next [-]

How? Biggest organisations and shared hosting providers had a chance to patch and protect their users. Everyone else will learn about the vulnerability the second patch comes out (this is also fixable with a configuration chance, so nobody needs to wait for their distro). This was the right approach and it worked.

	▲	jwitthuhn 2 hours ago \| parent \| next [-]
		They didn't release the patch out of fear that someone would quickly use the patch to develop an exploit, meaning an exploit is available shortly after the patch. What they have achieved by delaying the patch is that exploits are now available publicly before a patch. Surely this is the worse outcome.
	▲	ameliaquining 2 hours ago \| parent \| prev [-]
		The problem is that, since proofs-of-concept have leaked but the patch isn't available, bad guys can attack any site whose operators aren't part of the club, and the only thing the operators can really do to prevent that is to take the site offline. (PHP core team has denied that the configuration change fixes the problem.) I would call this a significantly worse outcome than everyone finding out about the vulnerability at the same time, since in that case operators can take timely action if they get the news quickly enough.

▲

heresie-dabord 4 hours ago | parent | prev [-]

> the industry will learn something

This is something of a fallacy. "The Industry" cannot learn.

But laws and regulations can require better security.

As in the history of seatbelts in vehicles, tech tool stacks are insecure by design and no one is ever really held accountable... until the cost is deemed too high.

It's evident that we have not reached that limit yet.