related (and good writeup): https://news.ycombinator.com/item?id=50378228
replyDamien Miller also provided some further details on openssh-unix-dev@: https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
reply> because we have recently observed multiple cases of
rapid bug rediscovery by AI agents, sometimes within hours, and so now
consider long embargo periods to be a dangerous practice that primarily
benefits attackers.
replySeems quite reasonable. It’s quite obvious that black hats have day jobs as White hats and have been privy to embargoes for probably decades.
I think this is a long held belief of the project and why they have been excluded from bug embargo’s in the past.
replyreply