undefined | Better HN

0 pointsmappu7y ago0 comments

> Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to?

You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk.

> That's a pretty unfair standard don't you think?

"An eye for an eye makes the whole world blind".

0 comments

3 comments · 1 top-level

throwaway20487y ago· 2 in thread

That makes a giant assumption that 12 month long embargoes protect anyone's safety (which is extremely dubious)

Its pretty much beyond debate that multiple malicious parties knew about the Intel issues many months before they were allowed to be fixed.

Coordinated disclosure is not some kind of unmitigated good.

cperciva7y ago

I agree that 12 month embargoes are stupid. I know that there are people, including FreeBSD people, who have been vigorously encouraging Intel to be more reasonable about how such issues are handled.

I played a small role in that after Theo announced the Lazy FPU issue, by writing exploit code and telling Intel (via the FreeBSD people in the embargo) "shorten the embargo or else".

busterarm7y ago

Given how much Intel likes to throw their weight around wrt embargo terms well past the point of being unreasonable, maybe it's a good thing that someone holds a gun to their head every once in a while.

If you want to lead market in mission-critical product, there's a certain amount of responsibility that you have to your customers and more than once Intel has lost sight of that.

j / k navigate · click thread line to collapse