it's literally the trolly meme but you're choosing who gets to be saved from being hacked. We know for a fact that you can't keep things secret if too many people know about it, and we're way past the "too many people NEED to know about it" phase.
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past
npub1sw…ny2dn
2026-10-22 01:45:22 UTC
in reply to nevent1q…pq78
Author Public Key
npub1swcr8w6tyv7apu54cuda5efm96mzfdl4hmg5fkcczyrjd396fpzqtny2dnPublished at
2026-10-22 01:45:22 UTCEvent JSON
{
"id": "8e885e27c27877c76b72272e0046b2d86f9476f3b5c7b44376902af8b50537ab",
"pubkey": "83b033bb4b233dd0f295c71bda653b2eb624b7f5bed144db18110726c4ba4844",
"created_at": 1792633522,
"kind": 1,
"tags": [
[
"e",
"005ceb33bdd0aaa8f9cca0fbc35916abb597cdd89fd1ccb6ede597e7786de91e",
"",
"root",
"9ca1002257e2d135a025575ce0f499658703e89a89921049435422b7f4b0da26"
],
[
"e",
"ffee66e08f866ef6d9cb5f8a35f7ec36f5bf679463884c5a1dfa8a8e0114065d",
"",
"reply",
"9ca1002257e2d135a025575ce0f499658703e89a89921049435422b7f4b0da26"
],
[
"p",
"83b033bb4b233dd0f295c71bda653b2eb624b7f5bed144db18110726c4ba4844"
],
[
"p",
"9ca1002257e2d135a025575ce0f499658703e89a89921049435422b7f4b0da26"
],
[
"proxy",
"https://friedcheese.us/objects/3fc496d2-c26b-4ecd-93f6-696385d8692d",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://friedcheese.us/objects/3fc496d2-c26b-4ecd-93f6-696385d8692d",
"pink.momostr"
],
[
"-"
]
],
"content": "it's literally the trolly meme but you're choosing who gets to be saved from being hacked. We know for a fact that you can't keep things secret if too many people know about it, and we're way past the \"too many people NEED to know about it\" phase.\r\n\r\nAnd do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?\r\n\r\nThese are the types of things we need to consider now and we should have been considering them a long long time ago.\r\n\r\nIf it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline\r\n\r\n\r\nsigned, \r\n\r\nsomeone who has previously been privileged to protect lots of embargoed CVEs in the past",
"sig": "fee16c9e051a14ddd0e548b7217ba72a1199fdba8efc94322481cd8c2cdecb785c4399ba1b3450fc6c6ead113c3f30149f9294a45ff3dad10c88cbfd5619fa92"
}