Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 21 Jun 2017 07:35:34 -0500
From: Josh Bressers <>
Subject: Re: Qualys Security Advisory - The Stack Clash

On Mon, Jun 19, 2017 at 3:39 PM, Solar Designer <> wrote:
> That said, we owe apologies to the community for violating the published
> distros list policy regarding the maximum embargo duration.  Personally
> and as distros list admin, I do apologize for letting this happen.
> I think we shouldn't have let it happen.
I suspect the extended embargo was exactly correct in this instance. Having
a policy you follow no matter what isn't ideal either (in fact it's
probably dangerous).

We've all been through a lot of embargoes, two weeks is more than
acceptable for most of them, it's a very good thing to have a forcing
function when needed. This one was special, nobody can deny that. It was
big, complex, and amazing. It ticked all the boxes. It affected a
substantial portion of the Internet. Had a name. Is a very old bug. Was
very serious. Had a great advisory and organization behind it.

Yet nobody flipped out. It was unexciting.

I suspect it was all so smooth because on Monday because everyone was
ready, everyone knew what was going on. There was no rushing, nothing was
on fire. There was time to develop patches properly. Everyone had their
story straight. It's quite likely if you force a release in two weeks
because that's the rule, someone not ready would create a story where one
shouldn't exist.

I applaud everyone involved. I'm sure there were issues, but I doubt such a
large effort could have gone better. Rules such as this exist to guide us,
don't let them constrain us.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.