they previously broke the KRACK embargo (among others): https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbh...
it's no surprise they're not high up on the list of important people to tell
it's no surprise they're not high up on the list of important people to tell
From https://www.krackattacks.com/#openbsd :
> As a compromise, I allowed them to silently patch the vulnerability.
Receiving permission to patch is the opposite of breaking an embargo.
> As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.
* https://news.ycombinator.com/item?id=16074531
That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017.
I still haven't nailed down how much advanced notice Matthew Dillion, author of DragonFly BSD, was given; although his apparent level of preparedness with patches on 2018-01-05 can be attributed to the fact that he actually talked publicly about the problem in April 2017, months before Google Project Zero secretly reported it to processor manufacturers in June 2017 in the first place.
Correct, but it’s significantly better than OpenBSD’s timeline (which learnt about it from the media). Mitigation for Meltdown is possible within of a week, or two. It requires working through the night, but it’s possible.
Mitigation after it’s in the media is a whole different situation.