Hacker News Reader

Comment by JshWright | Hacker News Reader

Given OpenBSD's pre-embargo leak of KRACK, I'm not sure why they feel entitled early access...

Except they didn't. This has already been debunked: https://news.ycombinator.com/item?id=16440826

The only reason the researcher gave permission was because the OpenBSD devs said that they were going to release on the original embargo date instead of extending out to 90 days like everyone else agreed to. They even say on their mailing list that they probably announced too much with their errata when they "silently" patched it. They techincally didn't break the embargo, but only because they refused to go along with what the rest of the community was doing.

> The only reason the researcher gave permission was because the OpenBSD devs said that they were going to release on the original embargo date instead of extending out to 90 days like everyone else agreed to.

“Said that they were going to”? More “expressed a desire to.” And that was a reasonable desire—so reasonable that the researcher willingly agreed, if reluctantly. https://marc.info/?l=openbsd-tech&m=152909822107104&w=2

Do you think it unreasonable for one project to strongly push back against a 180 day embargo? How about a year embargo? Two years? Is there any point where a project can say, “We believe extending the embargo beyond what we’ve agreed to is going to keep our users unpatched, and won’t succeed at keeping the bug secret, so we’d like your permission to release according to the schedule we agreed to,” or is that verboten since it’s not “going along with the rest of the community”?

OpenBSD didn't break embargo.

https://marc.info/?l=openbsd-tech&m=152909822107104&w=2

("Mathy" is the researcher who discovered KRACK.)

as I read it, it seems openbsd's X maintainer, matthieu herrb, knew about it but didn't tell theo or the other openbsd devs. that seems strange, and not really related to early access.

Reply on news.ycombinator.com