Hacker News Reader

Comment by __turbobrew__ | Hacker News Reader

Thank you for doing this instead of just vagueposting and wasting everyone’s time.

I'm inclined to expect that we should put the blame for that on whomever used legal channels to force Rachel to shut up, although obviously the jury is still out until we know more.

This is the only explanation that makes some sense, otherwise it would be just a dick move for someone to hint at the presence of an exploitable bug but then not say what exactly it is.

Not telling you how to hack a whole bunch of computers until the bug is fixed is called responsible disclosure. It's very popular, and depending on how the government is feeling that day, may be illegal not to do.

I'm reading "I can go into why another time." like "I don't have time" personally, not like "I am not allowed to say".

Then you are overlooking two things that provide important context: her previous behavior in similar circumstances of discovering bugs, and the opening sentence:

> My life as a mercenary sysadmin can be interesting.

To me this reads as "I was hired as a consutant for something that required a very restrictive NDA."

It might have just been responsible disclosure.

In that case: report the bug, keep your mouth shut until the bug is fixed, then talk about the bug once it is fixed or your responsible disclosure deadline has passed.

Turned out the bug was a 2.9 CVE nothingburger. It’s not like they found the FSB/Mossad/NSA had hooks in a remotely exploitable root level process.

Reply on news.ycombinator.com