2026-05-02 13:26 UTC
@icon_of_computational_sin@mstdn.starnix.network
>Let them deal with the consequences of pushing shit code into prod, this isn't your problem.
As I've said on IRC, you only say this because you don't have to deal with the chaos and panic in the aftermath of disclosing high severity issues before a fix is released. You never had to sit down and try to figure out which of your possibly hundreds or thousands of systems is affected and how to fix it.
Replies (1)
-
@icon_of_computational_sin@mstdn.starnix.network 2026-05-02 13:38
@phnt@fluffytail.org you might think so, but it was you who deployed vulnerable software from an untrustworthy vendor. Yes, you. You put your trust in a corporation that leaks (or worse, sells for profit) data left and right, hires subpar engineers, reluctantly spends pocket change on QA, and in a normal world wouldn't be trusted with candy. So called "ethical disclosure" only upholds this status quo of you and your kin pretending everything is fine. It's not fine. It hasn't been fine for a long time now. Full disclosure only reveals this very uncomfortable fact.