alt Hacker Newsif you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.
Replies
Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.
There is no way he didn't recognize the severity and massive impact of the vulnerabilities, go and try to find the CVE, fail to do so, think nothing of not being able to find it, and post.
We're also supposed to believe he didn't wonder why nobody else in his social media circles, lists, and forums were talking about it? He says he did what he did because he wanted to let people know.
We're supposed to believe he didn't stop and think "gosh, why is it falling to me to let people know about this?" It was mainstream media news less than 12 hours after it was announced.
> if you received the information about the RCEs without the information about the embargo, then you did not break the embargo.
Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?
In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.