Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Seems rather prisoner-dilemma-ish[1].

Up until now, there were no indications that this was being exploited publicly. After a flaw like this gets known (whether through a coordinated disclosure or through OpenBSD's early patch) you can be assured people will be exploiting this.

Do you both stay silent and take the minor risk of your users being vulnerable for a short time longer whilst patching and disclosure is being coordinated with all parties (-1/-1), or do you "betray party B" but get your own users secured as soon as possible (-3, 0).

I think coordination makes more sense in a flaw as big as this.

1: https://en.wikipedia.org/wiki/Prisoner%27s_dilemma



And be sure to note the iterated version which is where things get interesting https://en.wikipedia.org/wiki/Prisoner%27s_dilemma#The_itera... You can already see it in this case, where Theo "defecting" leads to less cooperation in future rounds.


For those who missed the FAQ,

> To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

i.e., _explicitly signalling_ that this researcher intends to play "defect" with OpenBSD in future rounds, should future rounds occur.


The lack of cooperation already happened. Agreeing to letting him patch and then throwing him under the bus for doing so.


I don't think it is just your users vs. all other users. Why are other vendors not patching as quickly?

In this case, it was not a short time.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: