TLP Is Not a Suggestion | Hacker News Reader

TLP Is Not a Suggestion

akamai.com

25 pointssneela10 comments

Whatever you want to tell people must not be that important if you can't have a human bother to write it.

Just stop with this bullshit. Its clearly well written and also looks human. I don’t know what miscalibrated false-positive confirmation bias ridden seventh sense you believe you have to magically spot AI writing, but it doesn’t work.

The independent researcher who published a proof of concept before the release did not.

Just to clarify that no actual PoC was published, just a demonstration video was floating about.

Doesn't matter. They video signaled to attackers that it was discoverable so they all pointed their clankers at the PHP source to go and find it.

And worth noting, Amazon’s MadPot started detecting exploit attempts four days before disclosure⁽¹⁾, so there were other leaks long before “the video”.

⁽¹⁾ https://aws.amazon.com/blogs/security/amazon-threat-intellig...

The only way I see to disincentivise first to publish is public shaming. Damaging the very reputation they are trying to inflate.

This blog post does well to remind or educate only for everyone else who's interests are actually aligned with public good.

The joke is "keep undisclosed to give enough time for the maintainer to fix"

Here we are just like having waited for a few years for a fix already...

Heh. We can’t even get people to stop using languages like C and C++ after all these decades of memory corruption exploits.

This article (which I only skimmed, since it appears to be clanker-written) seems to completely ignore the new world we're in with security vulnerabilities - once the bug is confirmed, it is easy for many people of moderate skill in the art to rediscover in independently with AI assistance. The work the independent researcher who confirmed it / released an exploit did could have been done by many people - and probably was, including by members of the blackhat community. The fine details of the vulnerability are no longer crown jewels, just some rough details are enough

TL;DR don't tell people something you don't want leaked?

Reply on news.ycombinator.com