That is incredibly damaging to the trust that coordinated vulnerability disclosure depends upon. The obvious consequence is that Chainguard should never again receive embargoed fixes in advance. You don’t get invited back into the room after demonstrating that you can’t be trusted with the information.
replyThey didn’t get to unilaterally decide that the embargo was inconvenient and publish early.
Why do you place a higher priority on maintaining coordinated vulnerability disclosure than of the safety of actual users of the software being protected?
replyThey made them available for everyone and free in this case.
replyNo, you don't, you just don't get older patched versions unless you pay.
replynot the ones related to this
reply