I am glad to have found this story, as it is newsworthy in its own right. The story you linked does not mention how early it was disclosed. I think marking it is a dupe is the wrong decision. (Same goes for changing the title.)

Hi dang,

Isn't this also newsworthy though? The vulnerability wasn't just discovered and posted to Twitter this morning, but rather mentioned nonchalantly on Apple's own Developer Forums back on November 13!

Exactly. I intentionally posted this separately, because it's particularly interesting where and how the vulnerability was originally posted. And it certainly seems to have attracted some discussion.

Sure it's interesting. It's the same vulnerability, though, and so clearly the same story by HN's standard. Our test for that tends to be rather coarse-grained because there are so few slots on the front page.

One indication of dupiness is whether the comments are different across the two threads. In the present case we've got comments about software quality at Apple, responsible disclosure, and so on, that are very much the same as the comments in the other thread. So it's really the original discussion spilling over.

For cases like this the best thing is to keep the auxiliary story as a link from the main thread. People will find it that way.

When that happens, is it feasible to merge the discussion threads somehow, such as somehow turning the post into a comment on the other story and including the discussion from that post under it?

Yes, we do that all the time. I'm not sure why we didn't in this case.

This item is very much not a dupe imho.

It points to the original, as far as we know, disclosure of the problem and a relevant discussion.