> because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.

Seems quite reasonable. It’s quite obvious that black hats have day jobs as White hats and have been privy to embargoes for probably decades.

▲

InsidiousWombat 3 hours ago | parent | next [-]

Embargo should last at most to the moment fix is made and code passes test suite.

Anything longer is putting systems at danger. I can recompile the package with a patch (even if Ubuntu/RHEL takes 3 weeks to do it) myself in a pinch, and I'd like to have a chance for it before the bug gets re-discovered by malicious party

▲

tremon an hour ago | parent [-]

What if the test suite passes in the middle of the night? Should all administrators interrupt their sleep and get up to recompile their servers immediately?

	▲	stonogo an hour ago \| parent \| next [-]
		That is generally the practice in professional environments, yes. Many places have an on-call rotation, and those that don't soon discover why. An embargo wouldn't fix that particular problem anyway, because time zones exist.
	▲	pgporada an hour ago \| parent \| prev [-]
		[dead]

▲

aomix 4 hours ago | parent | prev [-]

I think this is a long held belief of the project and why they have been excluded from bug embargo’s in the past.