Hacker News Reader

Comment by tonymet | Hacker News Reader

Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.

Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.

In plain english, please.

View on HN

The idea is that nobody has chance to have prior knowledge to identify or research the bug until it is generally possible to apply the fix immediately. If someone leaks the patch beforehand, others can inspect the bug and start exploiting it in the wild, while others have no chance to apply the patch.

Whether someone just leaked the CVE numbers or just ”there is a big bug in PHP” - that should not be enought to accelerate finding that bug. But other information that pins the bug for specific property or feature makes it easier to find and race against patching starts.

And at that point you don’t really know if someone really found it or not, since only few big organisations can collect that much data to detect successful exploiting. And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Until there is absolute evidence that exploitation happens in the wild, succesfully, you don’t leak the patch or bug details beforehand.

In this case, the area where the bug is in PHP, leaked partially, but apparently there was no enough evidence that it was exploited succesfully or if any of the PoCs in the wild actually worked properly. So patch or related detailed information was not released before the initial schedule.

Your later insights about the vuln POCs being a scam helped me better understand the situation.

I could see the value of the embargo in the old world of “6 uber security firms and a few bounty hunters” but the new world of pointing AI at the PHP source just seems flimsy.

> And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Could this be a variant of the survivorship bias? Maybe only the low quality PoCs ended up in the honeypots while the more capable actors avoided them.

This is absolutely not true. There are several things that leaked:

- The fact that there's a release, the CVE numbers, CVSS score and date/time (though wrong).

- Calif's video.

- Some advice from the mitigation document.

Despite this, the technical details of the vulnerability remained unclear, and exploits released up to that point missed the key mechanisms. Chainguard acted based on rumors and almost made the situation much worse for everyone.

This sounds like trying to prove a negative. “There were no POCs before the embargo date”. How are you so sure?

We checked them as claims came in to decide whether early disclosure was necessary. There were no reports of successful attacks, these were early and naive attempts. Furthermore, we were still waiting for distros to finish their builds and early disclosure might have helped aid in development of exploits as people were wanting.

Of course, we are not omniscient and cannot prove definitively nothing happened, but we acted based on the data that was available at the time.

fair enough. i'm not questioning the embargo timing necessarily. but the mea culpas and finger pointing about those breaking the embargo are unnecessary. there seems to have been enough insecurity and ambiguity that someone having a false start is at least understandable.

> but we acted based on the data that was available at the time.

That would also seem to apply to the OP so no embargo was broken by his post.

Reply on news.ycombinator.com