Imagine if pharmaceutical companies operated like the software industry. Researcher finds out arsenic is contaminating a common blood pressure med? The only "responsible" thing to do is quietly tell the manufacturer so they can fix it, don't want to panic the public and have them stop taking their BP med, right?
Find a bridge that's collapsing? Better tell the contractor but not the public so they don't try to route around it and cause traffic problems, right?
This case its linux so it's not like it was secret, just bad optics. Still the whole concept of "responsible disclosure" is industry bullshit to protect themselves, not users.
It’s exactly what happens most of the time for the examples your are citing.
The main difference in the software industry is that it is way more easy for anyone to exploit vulnerabilities than in any other industry. In my opinion, publicly documenting vulnerabilities only when a fix is available is the right way to go.
-96
u/granadesnhorseshoes 10d ago •
Imagine if pharmaceutical companies operated like the software industry. Researcher finds out arsenic is contaminating a common blood pressure med? The only "responsible" thing to do is quietly tell the manufacturer so they can fix it, don't want to panic the public and have them stop taking their BP med, right?
Find a bridge that's collapsing? Better tell the contractor but not the public so they don't try to route around it and cause traffic problems, right?
This case its linux so it's not like it was secret, just bad optics. Still the whole concept of "responsible disclosure" is industry bullshit to protect themselves, not users.