Given how security moguls are handling that, we should go back to "just release it, consequences be damned". Coz that gets normal people better chance of actually fixing it
That sounds oddly threatening, especially given that chainguard is in the right here. Embargoes are stupid in 2026 and make no sense. The rumor of this issue was enough for it to be independently discovered by several white hats and almost certainly many threat actors.
> Embargoes are stupid in 2026 and make no sense. The rumor of this issue was enough for it to be independently discovered by several white hats and almost certainly many threat actors.
The point of the embargo was to prevent all rumors? But it did not hold.
Releasing a statement that a critical security bug exists with no more information, does the opposite of preventing rumors. I think one of the most surefire ways of generating rumors is to say "something big will happen tomorrow, please don't speculate about it".
Anyway, GPs point is that even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently. So what is the purpose of waiting 24h before releasing the patches?
Yeah I don’t really get this, the rumor “there is some exploitable vulnerability in php” can’t really be the problem, because that’s probably known to everyone already. The rumor only helps you exploit it if there’s some specific hint how the exploit works.
Chainguard had a vague inkling that there was something in PHP and literally typed “find bad vulnerabilities in PHP” to a frontier model and independently discovered these.
What happens when you type the same into any other language is an exercise for the reader.
What are these "rules" you speak of? There's usually nothing binding in these agreements. It's just groups either trying to do the right thing by end users or trying not to look like assholes, get a better payout, or some combination thereof.
Finding an exploit and publishing is is not against the law. In some cases, publishing immediately is the responsible thing to do. For example, when it's actively being exploited in the wild, and waiting just puts people at risk that don't have any recourse to protect themselves, since they don't know they're at risk. There can be nuance to that as well, but in general, as soon as it's being exploited, anything that makes it harder for end users to a) know there is an exploit, or b) tell if they're susceptible to it (e.g. through a POC) is just taking away people's ability to take the action they deem appropriate.
I mean, this isn't really a surprise. On many social media platforms, you get instantly banned/shadowbanned if you post an external link, if you can publish that post in the first place at all. From the platform's perspective, there is almost no incentive to allow external links (spam, leakage etc). There is no law to mandate that third party links must be allowed.
I don't like this but also don't see how this can be different in the real world.
Having spent (way too much) time on HN, I have come to realize that there are people in this industry -- in fact quite a few of them -- who cares nothing about being nice/cooperative/helpful/pragmatic and getting things done, but just want to show off their ego/opinion and make a statement.
Many names come to mind but I am too scared to post that list.
If you tell me a piece of software that is not a password manager wants to send the first five characters of the hashes of my password to a third-party, without my explicit opt-in, I will say no without hesitation and without the need to hear more details. Not even if it's a random bit in the hash.
It's fascinating that you feel that way, but "I feel this is a threat" isn't really explaining why you feel it's a threat, especially when the purpose is to identify passwords whose full cleartext is exposed, which I'd rate as a far more substantial concern
If it's not in legal text, it doesn't exist, or matters.
If you don't want to support it, make it clear in license or README. Lots of projects work like that. Companies put "source available" or "open source but no external contribution" projects on GitHub and make it very clear what's the expectation. Nobody has any issue about that.
Somehow this guy thinks he is special.
If someone doesn't understand how licenses work, they should keep their work close sourced.
I'm not talking about legal texts. I didn't say he had a right to demand it, or that he should be awarded it by a court. There is no involvement of the legal system in this GitHub issue that I can see.
He acknowledged from the very beginning that the usage is licensed. Licenses aren't involved in the ask.
If you want a legal basis for this right, I suppose it would be GitHub's terms of service, with which his comments appear to be in compliance.
In terms of what is on-topic in this thread, he can state his terms for providing free, unlicensed support wherever he wants. He made it clear he wants nothing to do with support of this library in NixOS, in the place where it was most relevant to mention that.
> Chainguard unilaterally broke the embargo and published built images ...
Won't be the last time this happens. If there is no consequence of breaking the rules, people will keep doing that.
reply