Birbla

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

6 pointsby petecooper1 comments

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • The first rule of the fight club only applies if you know about the fight club.
    by ivanjermakov
  • You were not under any embargo. This only goes for the first person in the chain, whoever that was and there is absolutely nothing to apologize for.
    by jacquesm
  • What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?

    (For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

    by qubex
  • Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
    by cwillu
  • That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
    by rancar2
  • if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.

    this whole saga will be analyzed and we'll all come out better for it at the end.

    by john_strinlai
  • > At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

    I'm not saying it needs to be a public burning, but I sure hope someone figures out who dropped the critical metadata bit so they can avoid telling that party critical things in the future.

    by andrewflnr
  • > At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

    If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.

    Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.

    by creatonez

Explore Birbla archives