HN

Comments (111)

• Menu

  john_strinlai
  if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.this whole saga will be analyzed and we'll all come out better for it at the end.
• theteapot
  Don't feel too bad. Just knowing a "10.0" RCE CVE is inbound w/o extra details doesn't get you very far. The actions of calif.io and Chainguard after your post was what caused the damage.
• Menu

  rancar2
  That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
• Menu

  cwillu
  Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
• Menu

  qubex
  What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)
• siva7
  I also got that information before your post. I believe an embargo is impossible to keep up when it takes way too long to get a fix out.
• Waterluvian
  I really hope this isn’t chewing at you and that you’re just trying to do what you feel is the right thing by posting this.
• Menu

  ivanjermakov
  The first rule of the fight club only applies if you know about the fight club.
• iambateman
  Thanks Pete. I appreciate you taking the time to post here.
• minraws
  This does feel like the fix took so long to bake and was so obvious way too many people who are into PHP knew about it, I knew about eMudra's cert issue as soon as Chrome and Firefox pushed updates to disallow them for instance because of reasons, and it wasn't even fixed after it was all made public on several platforms, I think Apple still hasn't fixed it properly, the trust Store is still fucked not sure if Safari was separately patched, maybe there is an os update in the last few hours I missed.This entire RCE race is always annoying.
• Menu

  Magicrafter13
  are you the guy working at Chainguard publishing images...?
• jakelsaunders94
  Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.
• comrade1234
  So who will be sued and/or state prosecuted?
• Menu

  NamlchakKhandro
  It's ok. It's just php.
• medellin
  The security field is full of a bunch of self important jagoffs that think they are “super smart”. Its all a joke and its sad that anyone feels they need to play these stupid games.Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.
• ChrisArchitect
  Related (where you already posted a bit of this):Today's PHP security release, and how we're strengthening securityhttps://news.ycombinator.com/item?id=50182987
• drcongo
  You're a good person with good intentions. Hope you get some rest sir.
• aksss
  So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?Flame on!
• Menu

  tonymet
  Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.In plain english, please.
• bogomind
  [flagged]
• Menu

  possmap
  It happens. Information cascades are messy, especially with multi-layered contactsThanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters
• squidmaster
  [dead]
• aaron695
  [dead]
• KennyBlanken
  [flagged]
• Menu

  wewewedxfgdf
  x
• Menu

  voakbasda
  Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
• Menu

  deadnomore
  This is definitionally humble bragging. First of all the apology is in bad faith because there is nothing to apologize for. We are all giving the discovered CVEs attention (the brag component) under the guise of an apology (the humble component). I am being downvoted by well meaning, people pleasers that don't mind if they waste our time and attention doing it. Sounds great.