> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.
Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.
On one hand you have the OP, who is self reflecting. On the other hand you have Dan Lorenc from Chainguard.
The thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.
It was a selfish, PR exercise. He could have done it quietly. He could have just made sure his customers got an emergency patch quietly. (those who are willing and capable to patch) It is not common that anyone in the public could use his source except for his customers. It is difficult to just build from his source and drop it to any operating system and setup and expect it to work (let alone compliance and other requirements). Instead, he expected the public to thank him like he was actually doing an act of good. Loss for words, to be honest.
it was easy to find if you had the tokens even without the chainguard patch
The bragging by the discoverer made everyone start looking. Then when the PHP foundation made the announcement on the website there was a mad scramble. Up to 18 hours before release there were already demos. Look I get that it's a rock and a hard place but frankly at that point you should release the patch. I know there was a lot of fear over picking the wrong patch but having nothing is still bad.
got a link
https://www.linkedin.com/feed/update/urn:li:activity:7518756...
Yeah, I don’t think OP did anything wrong. Someone in the chain violated embargo, but it wasn’t OP.
Well, this is an iterated prisoner’s dilemma.
I’d say maybe it’s more like a Roko’s Basilisk. He knew the potential existence of an embargo, but didn’t do anything to protect the embargo. So now that the embargo turned out to be real, he will be punished. Otherwise if he truly did not know an embargo could even exist, he could not be blamed.
There was no embargo. If there's an "embargo" but parties not subject to the embargo know about it... there's no embargo.
There's no such thing as Roko's Basilisk, only Pascal's Wager.
Except he won’t be punished, because nothing he did was legally wrong.
He won't be punished by the legal system.
In the tech industry, there are punishments far worse than the legal system.
Would you please identify those you're thinking of?
on the darkweb you can pay people to break into wrongdoers houses and set their default browser to Edge. For extreme cases you can also have their TV connected to the internet and all EULAs accepted...
They might even force you to use PHP :P
People talk.
That is truly more frightening than a federal maximum security prison in the United States.
Nerd police!!!
isn't "coordinated disclosure" exactly about keeping, embargoing, a secret?
yes but if it reached you without an embargo it's kinda already not kept
and you weren't coordinated with