▲ 353 ▼ Root access vulnerability in glibc library impacts many Linux distros (securityaffairs.com) submitted 2 years ago by joojmachine@lemmy.ml to c/linux@lemmy.ml 79 comments fedilink hide all child comments
[–] Lightdm@feddit.de 4 points 2 years ago (1 child) I am not sure as well, but maybe they meant "maybe an early and public disclosure increases the urgency of the fix for the developers"? permalink fedilink source parent hideshow 2 child comments replies: [–] Devorlon@lemmy.zip 10 points 2 years ago (1 child) There have been cases [1] where vulnerabilities in software have been found, and the researcher that found it will contact the relevant party and nothing comes of it. What they're suggesting is that the researcher who discovered this might have already disclosed this in private, but felt that it wasn't being patched fast enough, so they went public. permalink fedilink source parent hideshow 2 child comments replies: [–] IAm_A_Complete_Idiot@sh.itjust.works 1 point 2 years ago The solution here generally afaik is to give a specific deadline before you go public. It forces the other party to either patch it, or see the problem happen when they go live. 90 days is the standard timeframe for that since it's enough time to patch and rollout, but still puts pressure on making it happen. permalink fedilink source parent
[–] Devorlon@lemmy.zip 10 points 2 years ago (1 child) There have been cases [1] where vulnerabilities in software have been found, and the researcher that found it will contact the relevant party and nothing comes of it. What they're suggesting is that the researcher who discovered this might have already disclosed this in private, but felt that it wasn't being patched fast enough, so they went public. permalink fedilink source parent hideshow 2 child comments replies: [–] IAm_A_Complete_Idiot@sh.itjust.works 1 point 2 years ago The solution here generally afaik is to give a specific deadline before you go public. It forces the other party to either patch it, or see the problem happen when they go live. 90 days is the standard timeframe for that since it's enough time to patch and rollout, but still puts pressure on making it happen. permalink fedilink source parent
[–] IAm_A_Complete_Idiot@sh.itjust.works 1 point 2 years ago The solution here generally afaik is to give a specific deadline before you go public. It forces the other party to either patch it, or see the problem happen when they go live. 90 days is the standard timeframe for that since it's enough time to patch and rollout, but still puts pressure on making it happen. permalink fedilink source parent