alt Hacker NewsThe thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.
Replies
r_lee • today at 7:23 AM
it was easy to find if you had the tokens even without the chainguard patch
➕ show 1 reply
It was a selfish, PR exercise. He could have done it quietly. He could have just made sure his customers got an emergency patch quietly. (those who are willing and capable to patch) It is not common that anyone in the public could use his source except for his customers. It is difficult to just build from his source and drop it to any operating system and setup and expect it to work (let alone compliance and other requirements). Instead, he expected the public to thank him like he was actually doing an act of good. Loss for words, to be honest.