Exactly. I intentionally posted this separately, because it's particularly interesting where and how the vulnerability was originally posted. And it certainly seems to have attracted some discussion.

Sure it's interesting. It's the same vulnerability, though, and so clearly the same story by HN's standard. Our test for that tends to be rather coarse-grained because there are so few slots on the front page.

One indication of dupiness is whether the comments are different across the two threads. In the present case we've got comments about software quality at Apple, responsible disclosure, and so on, that are very much the same as the comments in the other thread. So it's really the original discussion spilling over.

For cases like this the best thing is to keep the auxiliary story as a link from the main thread. People will find it that way.

When that happens, is it feasible to merge the discussion threads somehow, such as somehow turning the post into a comment on the other story and including the discussion from that post under it?

Yes, we do that all the time. I'm not sure why we didn't in this case.