Agree. If I'm following along correctly, it seems Calif is really the one to blame not Chaingaurd.

Both are to blame.

Calif more than Chainguard, but still Chainguard too.

Calif was obviously twitching to claim credit for their findings, and what I find troubling is this eagerness was more important to them than giving users a chance to update their systems.

Even if they ended up waiting only a day post release I would still say it seems a bit too soon. Maybe a week after. Not everyone’s system have aggressive patching schedules and PHP is soo heavily used.

▲

kjs3 a day ago | parent | next [-]

This is probably the future, tho. Being first to disclose a vuln is a Big Deal in some quarters. And now, the velocity of AI driven pentest swarms mean every researcher who finds something worthwhile has to think "how close is the next droog's swarm to finding what I found" and the temptation to jump the gun only gets stronger.

	▲	yardstick a day ago \| parent [-]
		Yeah I completely understand the motivation. I just wish they were more pragmatic to the security risk vs building their reputation.

▲

OrderlyTiamat 16 hours ago | parent | prev [-]

I can't blame Chainguard for breaching an embargo which was already nonexistent at the time. If the embargo is broken already, they have a duty to their customers to upload as soon as possible.

All parties have that duty, but it's better if they do that at the same time.

... That's why you have an embargo.