The parent is getting downvoted but he is absolutely right. Do not ever do what you just did. It makes you an easy target for a frivolous lawsuit in the US or in other countries because of the potential liabilities in your message, they are real. Even if you didn't do anything wrong, you are painting a target on your back, for no reason. I would ask HN to delete that thread directly.
You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.
Anyone can sue anyone else for any reason. We should encourage honesty and transparency, not discourage it.
While possibly true in theory, in practice it's not. Courts and judges do not take kindly to frivolous or unsubstantiated claims, and any halfway good attorney would advise you to not waste your money and your time on a claim you are unlikely to win or be able to collect on.
People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.
This isn't a matter of transparency, was the OP legally bound not to disclose the RCE? That whole "embargo" was pure courtesy between the people involved. The OP committed no fault at first place and the exploit was already in the wild anyway. Whoever really wanted to exploit it before the patch could without using the OP as a source.
> Anyone can sue anyone else for any reason.
And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.
To win, the cause needs to be a broken law or contract. Neither are here.
There's at least some evidence in the other direction.
https://med.stanford.edu/news/all-news/2017/10/in-patient-in...
> New research shows that discussing hospital errors with patients leads to better patient safety without spurring a barrage of malpractice claims.
It has nothing to do with anything I said.
Sure it does. Saying sorry sometimes reduces liability risk, which is quite counterintuitive at first.
> Sure it does. Saying sorry sometimes reduces liability risk, which is quite counterintuitive at first.
No it doesn't have anything to do with what I said. The OP has no contractual or legal obligations toward any community, unlike a doctor and their patients in case of medical error.
edit:
> A doctor has no contractual obligation to apologize, either.
> But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.
OP isn't a doctor as far as you know, and isn't apologizing to a specific person. OP can't be bound to an embargo he didn't know about and wasn't involved in any decisions.
You're completely off topic and you just want the last word.
Your ramblings have nothing to do with anything I have said.
A doctor has no contractual obligation to apologize, either.
But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.