9 years may seem like a long time, but its also just a DoS vuln. Which is a real security issue in many contexts, but its not exactly a high severity one
From the article, "this attack was due to a 9 year old bug in the Go standard library. During the "post-mortem" @protolambda, @prestonvanloon, @raulk and I uncovered this bug," so at least they are quite clear that it is a recently discovered bug.
It is unambiguous. Neither interpretation says that the bug is newer than nine years vintage.
> Interesting that you and another commenter interpreted "9 year old bug" to mean "bug discovered 9 years ago".
In an unusual moment of reduced cynicism, I too interpreted it as that the bug was newly (or at least recently) discovered whcih does appear to be the case this time.
It could easily have been a bug discovered that long ago that was for some reason marked WONTFIX (the danger not appreciated, that bit of code was at that time due to be deprecated RealSoonNow, ...) or CANTREPRO.
> From the article
Yep. The fault lies with whoever named this submission. It isn't as if they've just used the title of the page linked to, as that differs completely, so a thought process happened and a wording decision was made.
There must still be confusion, as when I read the title it means exactly what is said in the GitHub issue.