I literally know them in person. It's a guy. They have a signal and an email right there, you can message them and talk it's not that deep

Can you tell them that they're acting recklessly here then?

Are they, though? I seriously doubt some sysadmin is going to look at this and say "Maintainers said to patch, but clearly _this guy_ knows better, so I won't."

Besides, he's got a point. The initial PoC that kept popping up on Mastodon (the ones he linked in the post as well) simply didn't work. One of them even posted an updated exploit later that still didn't work, but supposedly meant the vulnerability went from CVSS 10 to CVSS 4.

I know someone who hacked his own site using the exploit and managed to obtain a database dump.

Well, tell him from me, he'll probably regret writing the article when he reaches his thirties.

Which, if true, would at least be kinda funny and would hit institutions that deserve it for having failed to hire trustworthy people that aren't susceptible to that.

So that's a silver lining I guess.

Whoever gets pwned due to this might get naturally out-selected. The system works!!11 Thank you darwin.

If Satan himself proves a theorem, is it nevertheless a true theorem? Claims are either true or they are false. There is no such thing as an evil truth. Where are the breaches?

But don't you understand? The aim wasn't to prevent the breaches that would inevitably happen on day one; it was to prevent the breaches that would happen after that fact. Without mobilising everyone and getting people to patch through an event, we'd be in a far worse position.

The greatest trick that Devil performed was convincing people that he didn't exist, right?

Doubtful. See the only other post on their blog written on Oct 2,2026 . It argues the exact opposite : https://eliastaylor.com/software-tinderbox/