| ▲ | ebilgenius a day ago |
| If they're gonna unilaterally release an exploit patch 6 hours before an agreed upon embargo for a CVSS 9.2 that affects like ~70% of the internet then they better have reams of evidence showing this was being exploited in a widespread manner and not just "we saw a dancing anime girl edit of a theoretical exploit on twitter, so we had to release it to the world" |
|
| ▲ | b112 a day ago | parent | next [-] |
| And evidence they at least gave a heads up to everyone in on the embargo, eg "I have to release you all have 1 hour to get on board". There is a MASSIVE difference between a small number of people exploiting in the wild, and a few hours after a release a bazillion script kiddies doing so. The move to release and break an embargo was childish, absurd, self-serving, and lacking in all common sense. Not to mention, breaking trust. I agree with those in this thread who say, never going to do business with them. Ever. |
| |
| ▲ | richwater a day ago | parent [-] | | > Not to mention, breaking trust. I highly doubt their paying customers feel the same way | | |
| ▲ | yardstick a day ago | parent | next [-] | | Maybe, but if I was maintaining PHP or another critical software, I’d think twice about letting Chainguard have inside information. I would let Chainguard deal with the patches post official release like all other unreliable parties. | |
| ▲ | b112 a day ago | parent | prev [-] | | A weird take. As a customer, I'd immediately assume no one in the security community would trust them again, and seek someone else to give my money to. Why pay a) an untrustworthy company who b) now is not trusted by anyone and c) won't ever be able to early release again anyhow? And if anything, are left out of important conversations. Way to burn bridges. You only get to be an asshat once. | | |
| ▲ | dylan604 a day ago | parent | next [-] | | > You only get to be an asshat once. I have seen no evidence to back up this claim. Quite the contrary actually. | |
| ▲ | richwater a day ago | parent | prev [-] | | > You only get to be an asshat once. TIL observing an exploit in the wild, after the details leaked during the embargo and pushing a fix for your customer is "being an asshat". | | |
| ▲ | angry_octet 3 hours ago | parent [-] | | But they didn't observe any exploits in the wild. They may have believed there were exploits, but no evidence of this. Also no evidence that sought to communicate the need to end the embargo earlier. Instead they sought short term commercial advantage. My advice to their customers is to leave, Chainguard will be the last to know about exploits in future. | | |
|
|
|
|
|
| ▲ | lenerdenator a day ago | parent | prev [-] |
| It's the age of LLMs. Exploits go from theoretical to real fairly quickly. PHP's open source, it's not impossible to conceive of someone seeing that video, getting the general idea of what to do, and working the rest out with a decent model. |
