News for hackers. Stuff that matters.

A comment on CopyFail was not disclosed to Gentoo developer. Parent comment

Re:CopyFail was not disclosed to Gentoo developer by dotancohen on Friday May 01, 2026 @04:36AM (#47972483)
A rogue actor may create a new distro, maybe for some niche use case such as accessibility or retro gaming. After acquiring enough false (and even some real) users that the Linux Foundation accepts them as a notifiable distro maintainer, this maintainer could then pwn machines before the exploit is made public.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by mort96 on Friday May 01, 2026 @04:44AM (#47972515)
I didn't say all distros should be notified, for that exact reason. I listed a handful of major fistros.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by steve1977 on Friday May 01, 2026 @04:56AM (#47972583)
Who gets to decide who the lucky few are?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by mort96 on Friday May 01, 2026 @05:38AM (#47972802)
Sounds like a job for the Linux Foundation maybe?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by lillecarl on Friday May 01, 2026 @05:22AM (#47972719)
Human beings
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by steve1977 on Friday May 01, 2026 @05:34AM (#47972786)
Qualified by what?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by Dylan16807 on Friday May 01, 2026 @09:13AM (#47974424)
Are you implying it requires expertise to figure out the ten (plus or minus a factor of two) biggest distros? I think most people that understand the context of the question can figure out pretty similar lists.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by danlitt on Friday May 01, 2026 @04:40AM (#47972503)
Rather than the current situation, where they can pwn machines after the exploit is made public?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by dotancohen on Friday May 01, 2026 @06:11AM (#47973003)
Yes. After the exploit is made public, the window of opportunity closes quickly.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by danlitt on Friday May 01, 2026 @10:22AM (#47975144)
Not if people don't get notified!
[ Parent | on HN ]