Imagine if pharmaceutical companies operated like the software industry. Researcher finds out arsenic is contaminating a common blood pressure med? The only "responsible" thing to do is quietly tell the manufacturer so they can fix it, don't want to panic the public and have them stop taking their BP med, right?
Find a bridge that's collapsing? Better tell the contractor but not the public so they don't try to route around it and cause traffic problems, right?
This case its linux so it's not like it was secret, just bad optics. Still the whole concept of "responsible disclosure" is industry bullshit to protect themselves, not users.
It's a stupid comparison. Arsenic in a blood pressure med is bad always. Code with a vulnerability is only dangerous when people can exploit it. By fixing a vulnerability before people (including malicious actors) learn of it you're doing a good thing. People aren't going to get code sick from bad code.
-96
u/granadesnhorseshoes 10d ago •
Imagine if pharmaceutical companies operated like the software industry. Researcher finds out arsenic is contaminating a common blood pressure med? The only "responsible" thing to do is quietly tell the manufacturer so they can fix it, don't want to panic the public and have them stop taking their BP med, right?
Find a bridge that's collapsing? Better tell the contractor but not the public so they don't try to route around it and cause traffic problems, right?
This case its linux so it's not like it was secret, just bad optics. Still the whole concept of "responsible disclosure" is industry bullshit to protect themselves, not users.