Much appreciated
> Messaging or tagging you there about an unpatched RCE would have effectively been a public zero-day disclosure, which we strictly wanted to avoid.
No one is saying that, huh? Are we following the same timeline? At this point you have emails out to me a Hisham. You aren't hearing back from us, it's been a while. The issue seems pretty bad. Any way of nudging either of us to check, "Hey, something important about LuaRocks, check your email" in a dm, or a message to anyone else related to LuaRocks. There's a million ways to get my attention without publicly disclosing the issue. Dang, even you could have sent an email.
> That, too, would have been a public disclosure.
I wasn't suggesting you publicly disclose. I'm trying to understand how you understood what was at stake. You have your own community of users with rocks.nvim consuming files through luarocks.org that would potentially be installing malware. I also asked you "Did you stop using LuaRocks?" I'm trying to assess if you just didn't see it as that severe of an issue.
Look, I fully accept your defense of "We did what was in SECURITY.md. Not our fault that the emails were never delivered. Anything else is outside our responsibility. " If you're just some random security researcher, I accept it. My argument is that you aren't a rando and you're more tied to the ecosystem, and have more responsibility. But maybe you disagree.
> Rather than going back and forth on motives, how about we focus on establishing a clearer direct line of communication for the future?
Yes, thank you! I've been waiting for email from anyone at this point. I tried to get info from Vhyrro way before this HN thread but got ignored https://github.com/vhyrro/luarocks-rce-proof-of-concept/issu...
> Since I did not conduct the research myself, I am not in a position to comment on the technical details of it.
You have enough intimate details of the situation to participate in a multi-day conversation with me on behalf of Vhyrro's work but conveniently don't know anything else? Were you a politician in another life? :)
I will follow up with your email, thanks
Sorry for all the snark, I hope you can at least empathize a little with my situation.