Exactly. I assume if one of the smaller providers like Linode found an internal vulnerability that they thought was a big security risk to have widely know and had 3 giant customers and a large number of smaller customers, they’d work directly with the giant customers in advance in the same way.

I was a Linode customer back when there was a security incident where everyone found out on Reddit before the company bothered to tell anyone. And then once news did come out they never said (a) what happened or (b) what steps were taken to prevent it happening again.

I am very reluctant now to trust the little guys with anything remotely mission critical.

I am resisting the urge to make a Linode and ColdFusion joke.

This proverb is mostly not true. I've worked in high-secrecy areas and everybody keeps their mouth shut because they're terrified of the consequences to their career.

Three can keep a secret if two are bound by an NDA is closer.

I think in a tightly bound organization where all incentives are well aligned, that can be true.

There was a leak.

Typing this from Ubuntu - still no updated kernels yet.

It wasn't so much a leak as someone putting two and two together and the cat getting out of the bag.

Anyway, this is a nonsense argument in the context of the thread. They tried to keep things quiet by limiting the size of the circle, among other things. Their attempts at secrecy did not entirely succeed, although they made it 90% of the way to the embargo date without things coming out. Their inability to make it 100% of the way does not inform us at all about whether they should indeed have limited the circle of those who knew.

Should be coming on/before Tuesday: https://insights.ubuntu.com/2018/01/04/ubuntu-updates-for-th...

If I'm not mistaken, this was the same approach taken when dealing with heartbleed.