upvote

points

by yreg6 hours ago |
comments
upvoteby dannyw6 hours ago|
[-]
Let's hope so. Shall we create a new norm? A 365 day timeout, for companies like Chainguard that deliberately break embargoes.

Very irresponsible behaviour in my opinion; and if it's a decision made unilaterally by their CEO, probably a breach of their SOC 2 certification. What's next? "$X isn't patching this CVE fast enough, here's a binary blob of our fix, don't worry, we're making this free!"

reply
upvoteby cobolcomesback6 hours ago|
parent|
next
[-]
Nah, Chainguard should be praised for this. It was a different company that leaked the POC early, and then PHP, Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild. Chainguard did the right thing by getting the fix out as quick as possible to stop the bleeding (or gushing flow of blood, really) rather than sitting on it so they could make a coordinated marketing post, like the others did.
reply
upvoteby kstrauser6 hours ago|
parent|
next
[-]
That's a reasonably take. Embargos only work until the information's leaked, and once that's happened, however it happened, the bad guys have the exploit information and the clock starts ticking.
reply
upvoteby chrisvls5 hours ago|
parent|
[-]
PHP’s view is that Chaingiard started the clock because the video was insufficiently detailed. Not sure if that is the case, but just sharing I had a different reading of the statement.
reply
upvoteby eterm5 hours ago|
parent|
[-]
It was being discussed on here hours prior to the Chainguard release.
reply
upvoteby 2 hours ago|
parent|
prev|
next
[-]
deleted
reply
upvoteby gruez5 hours ago|
parent|
prev|
next
[-]
>... Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild.

What was Wiz/OpenAI supposed to do? PHP was already aware of the issue.

reply
upvoteby kijin5 hours ago|
parent|
prev|
next
[-]
But did they "get the fix out"?

They released some binaries, built for their own docker image based on their own Linux distro. Other people couldn't use Chainguard's "fix" to patch their own systems. The only people who seem to have benefited from the stunt are the hackers who used AI to reverse-engineer the binaries and write exploits.

That was a giant fuck-you to the rest of the PHP ecosystem, nothing more.

reply
upvoteby 4 hours ago|
parent|
[-]
deleted
reply
upvoteby bawolff5 hours ago|
parent|
prev|
[-]
> It was a different company that leaked the POC early,

[citation needed]

By which i mean, this seems untrue. If you mean the anime video, that is not a leak of a PoC.

reply
upvoteby cryptonym6 hours ago|
parent|
prev|
next
[-]
I think multiple companies didn't respect the embargo, in different ways.

That can be for marketing purposes or by mistake. Not sure how to deal with that.

reply
upvoteby martinjc6 hours ago|
parent|
next
[-]
Chainguard effectively held everyone hostage, and forced everyone hosting container images and wanting to be online, to trust their builds and then saying they did it for "free" to get free advertisement. Incredibly irresponsible behavior. They used this as a big fat advertisement board.

Dont trust us with information lol.

reply
upvoteby dannyw6 hours ago|
parent|
prev|
[-]
A security vendor entrusted with advanced patches breaking embargo, is much worse than a security researcher breaking embargo.
reply
upvoteby jamietanna3 hours ago|
parent|
prev|
[-]
> What's next? "$X isn't patching this CVE fast enough, here's a binary blob of our fix [...]"

https://www.chainguard.dev/athena

https://www.chainguard.dev/unchained/this-shit-is-hard-build...

reply