This is just one of many reasons to release the patch and the builds at the same time. It's much harder to verify the patch is in there when all the users are in the dark about what the issue was, and what the fix was.
This type of embargo is indefensible.
That doesn't apply to ALL types of vulnerability embargos, but it absolutely does here, and I've been consistently saying this since before the news of this latest fuck up broke.
quotingIt's sad to see open source project shipping closed source binaries. 🤮 It goes against best practices because it prioritizes the attackers over the users.
nevent1q…5yf6
Attackers will reverse engineer an executable and bindiff it to find the patch, and possibly find code paths that the initial patch missed.
The users will be left in the dark about what was wrong, what was fixed, and whether the patch really fully addresses the issue or not.
With the exception of the full-disclosure crowd, the infosec industry agrees that it's best to keep the details under embargo until the patch is written and tested, then release the patch (binary and source) along with all of the details. The industry has been facing this problem since at least the 90s. It's extremely well understood and we have decades of evidence that led us to this conclusion.
Some exceptionally critical software projects post a notice saying that a security update will be released at a given date and time (in UTC) along with how severe the vulns are that are being patched. OpenSSH does this. This allows users to be ready for when the patch drops.
The outliers in the industry advocate for full disclosure before a patch is available, sometimes including an exploit to demonstate the issue is real and to allow people to test their mitigations and patches. Linux does this.
Opinions vary about whether it's appropriate to publish an exploit at the same time as the patch (or at all).
Opinions also vary about how long developers should get to fix the issues before the person who found the issue tells the users directly. It used to be 90 days and then the details drop whether there's a patch or not. There's been a push for shorten this to 30 days.
If you are a developer in any open source projects, please do security disclosures properly. If you don't believe me saying this is how its done, just look at how the open source projects who power the majority of the internet handles these things. By hiding the details from the very users you're supposed to be serving, you're putting your project's reputation on the line.
Vulnerabilities happen, nobody should fault you for that (unless they're happening non-stop...), but we will fault you for how you handle it after you find out about them.
nevent1q…uqzd