alt Hacker NewsLet's hope so. Shall we create a new norm? A 365 day timeout, for companies like Chainguard that deliberately break embargoes.
Very irresponsible behaviour in my opinion; and if it's a decision made unilaterally by their CEO, probably a breach of their SOC 2 certification. What's next? "$X isn't patching this CVE fast enough, here's a binary blob of our fix, don't worry, we're making this free!"
Replies
jamietanna • today at 7:47 PM
> What's next? "$X isn't patching this CVE fast enough, here's a binary blob of our fix [...]"
https://www.chainguard.dev/athena
https://www.chainguard.dev/unchained/this-shit-is-hard-build...
cryptonym • today at 4:49 PM
I think multiple companies didn't respect the embargo, in different ways.
That can be for marketing purposes or by mistake. Not sure how to deal with that.
➕ show 2 replies
Nah, Chainguard should be praised for this. It was a different company that leaked the POC early, and then PHP, Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild. Chainguard did the right thing by getting the fix out as quick as possible to stop the bleeding (or gushing flow of blood, really) rather than sitting on it so they could make a coordinated marketing post, like the others did.