Yahoo! released Axis (with this very dumb mistake) at 5pm PST, and by 9pm PST their public key is posted, with a "I report this but have yet to hear back" note. How, exactly, is this responsible disclosure?
The way this came about was a bit different, because it started with a tweet[1] where I pointed out that the file was there, and then it gradually developed into realizing that it is a pretty big deal. The discovery happen out in the open. If you look at my timeline and the replies and conversations you will see how it came about.
With hindsight I could have handled it differently, but it just happen to come out in this way. I added an update to the end of the post addressing disclosure. The goal at the moment is to make users aware that there is potentially a big issue here.
This is not an obscure bug. This is obvious -- very obvious. Many people will have discovered this already. Furthermore this is a pre-release product.
There is nothing to be gained by not talking about it.
its not responsible disclosure but then again, everyone could see the key after an hour. it's not like if it was a complex exploit. Its more like if you printed the password to your stuff on a document and told the world to grab a copy. ;-)
Please stop parroting "responsible disclosure" like a white knight, and engage your brain.
In the case of a private key exposure, the only possible fix is to tell everyone to stop trusting that key. That's exactly what happened here.
As I understand it, responsible disclosure is primarily there to protect the userbase of a piece of software, not the reputation of the producer of that software.
And surely they can't be being stupid enough to be using this same signing key on established products, can they?
On reflection, scrub that last thought.
If this is the only thing signed with this key, then the attack surface is only people running this thing.