I waddled onto the beach and stole found a computer to use.

🍁⚕️ 💽

Note: I’m moderating a handful of communities in more of a caretaker role. If you want to take one on, send me a message and I’ll share more info :)

  • 1.8K Posts
  • 5.99K Comments
Joined 3 years ago
cake
Cake day: June 5th, 2023

help-circle










  • The discussion is full disclosure vs responsible disclosure. I think almost everyone who is familiar with the situation agrees that:

    • yogthos didn’t create the vulnerability
    • the vulnerability should be patched, and the public needed to be made aware of them

    I don’t see why full disclosure is still being suggested as having been the right call in this case. A patch would have come out just as fast with a responsible disclosure, and there was nothing that users of Lemmy or Piefed could do by becoming aware of it right away. Meanwhile the full disclosure harms regular users, instance operators, and developers alike. I think it would ALSO be bad if someone did this to the Lemmy developers, or any other project.

    Responsible disclosure would have meant

    • contact the developer and wait a reasonable time for a patch
    • contact instance operators to let them know that they may want to take steps before the patch is out

    Even if we assume that malicious entities are actively exploiting the vulnerability, which is an assumption and not confirmed, publicly promoting it only makes the problem worse and doesn’t speed up any resolution.

    I understand that there is also tension between Yogthos and Rimu. I think Yogthos would have come out of this looking a lot better if they went with responsible disclosure











  • I think the original title was more helpful because it shows that this is a recent development. Maybe you can add “new CEO”?

    Bitwarden scrubs ‘Always free’ and ‘Inclusion’ values from its website as longtime execs step down

    In February, longtime CEO Michael Crandell moved to an advisory role, according to LinkedIn, with no announcement from the company. His replacement, Michael Sullivan, former CEO of both Acquia and Insightsoftware, touts his experience with “all facets of mergers and acquisitions” on his own LinkedIn page, including experience working with leading private equity firms.

    CFO Stephen Morrison also left Bitwarden in April, replaced by former InVision CEO Michael Shenkman. Both Crandell and Morrison joined the company in 2019. Kyle Spearrin, who started Bitwarden as a fun hobby project in 2015, remains the company’s CTO.