The discussion is full disclosure vs responsible disclosure. I think almost everyone who is familiar with the situation agrees that:
- yogthos didn't create the vulnerability
- the vulnerability should be patched, and the public needed to be made aware of them
I don't see why full disclosure is still being suggested as having been the right call in this case. A patch would have come out just as fast with a responsible disclosure, and there was nothing that users of Lemmy or Piefed could do by becoming aware of it right away. Meanwhile the full disclosure harms regular users, instance operators, and developers alike. I think it would ALSO be bad if someone did this to the Lemmy developers, or any other project.
Responsible disclosure would have meant
- contact the developer and wait a reasonable time for a patch
- contact instance operators to let them know that they may want to take steps before the patch is out
Even if we assume that malicious entities are actively exploiting the vulnerability, which is an assumption and not confirmed, publicly promoting it only makes the problem worse and doesn't speed up any resolution.
I understand that there is also tension between Yogthos and Rimu. I think Yogthos would have come out of this looking a lot better if they went with responsible disclosure


