Re:Theo de Raadt on OpenSSL vulnerabilities coming on the 19th
by detaro on Tuesday March 17, 2015 @09:49AM
(#9217847)
We mostly don't know if it is already "in the wild" or not, if it will be found independently during the embargo period, if it will leak out of one of the organizations "in the know", ...
Didn't people find traces of hearthbleed attacks that happened months before it was published?
There are good arguments for very short embargo periods, especially if you mostly care about the security of your users. (of course, in a perfect world every vendor would be willing/able to release patches after 24 h or so, and it wouldn't matter, but we don't have one of those...)
Didn't people find traces of hearthbleed attacks that happened months before it was published?
There are good arguments for very short embargo periods, especially if you mostly care about the security of your users. (of course, in a perfect world every vendor would be willing/able to release patches after 24 h or so, and it wouldn't matter, but we don't have one of those...)