Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.
Reality is that everyone has to make decisions in finite time, using the resources they actually have.
And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.
>And question how many other people they might have blabbered to.
100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
That's fair. For clarity: I take responsibility for posting on HN, without knowing the facts.
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
The Japanese PM did not “have” to get involved.
Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.
Reality is that everyone has to make decisions in finite time, using the resources they actually have.
And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.
>And question how many other people they might have blabbered to.
100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.
The first rule of the fight club only applies if you know about the fight club.
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
I am not in the US.
Related (where you already posted a bit of this):
Today's PHP security release, and how we're strengthening security
https://news.ycombinator.com/item?id=50182987
It happens. Information cascades are messy, especially with multi-layered contacts
Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters