The thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.

got a link

I’d say maybe it’s more like a Roko’s Basilisk. He knew the potential existence of an embargo, but didn’t do anything to protect the embargo. So now that the embargo turned out to be real, he will be punished. Otherwise if he truly did not know an embargo could even exist, he could not be blamed.

Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious.

This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".

Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.

The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.

These terms are obviously not super scientific, but I try to point out the history whenever it comes up.

That approach to disclosure is about discovering vulnerabilities. Talking about something with a published CVE isn't really comparable.

> Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?

Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.

No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.

For example: https://www.cve.org/CVERecord?id=CVE-2026-50000

No, CVEs can be allocated before a vulnerability has even been found!

By now I've seen at least 5 different people or companies blamed for leaks or releasing fixes early.

If anyone is at fault here, I'm looking at the PHP maintainers.

The embargo apparently held for like two months, during which they have not managed to release patches.

If you're seriously asking whether or not it's possible that someone was overconfident and thoughtless rather than malicious and calculating... yeah I find that very easy to believe. Process safety exists because as individuals and as groups we suck at this.

Okay, my bad. I didn't know he was not participating in the embargo.

This is exactly how it works. People who are part of the embargo are responsible for making sure that anyone they share information with -- which should usually be nobody! -- are aware of and abide by the embargo.

you cannot be subject to an embargo of which you had no knowledge and took no participation in.

the embargo was already broken when pete received the information.

So if I read the post here and told someone, would I be breaking the embargo?

This is not a situation where "Ignorantia juris non excusat" applies.

Yes, it is.

How would you even know whether you knew the facts? It sounds like what you knew was more than just consistent with there being no embargo, you were explicitly told there was no embargo. After a certain point, there's a limit to how far up the chain any of us can be expected to follow the logical chain of what we genuinely think are true, and this doesn't seem like a glaringly obvious case where you were being reckless.

We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.

At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.

You’re “taking responsibility” for doing nothing wrong.

Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

>And question how many other people they might have blabbered to.

100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.

Relax. You did no wrong. You reacted to the information that was ‘local’ to you. I am merely objecting (hopefully humorously) to the phrase “take full responsibility “: it is uncalled-for, unnecessary, and vacuous. Try to have a good Thursday. Tuesday was not your fault.

I might be in Cornwall in a bit, so I might take you up on that :)

But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.

Oh and I’m from Bristol. We might have more in common than you’d expect.

The takeaway shouldn’t have been “don’t post” (mainly because someone else would have) but instead “news reporting is hellaciously inaccurate”.

Shit happens.

Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.

I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.

Honestly though, dont beat yourself up over this.

    As the executive cowered, Watson asked, "Do you know why I've asked you here?"
 
    The man replied, "I assume I'm here so you can fire me."
 
    Watson looked surprised.
 
    "Fire you?" he asked. "Of course not. I just spent $10 million educating you."

“Nobody else’s fault but mine” is a perfectly good way of asserting “nobody else’s fault but mine”; “I take full responsibility” is something else entirely and the two are not synonymous. Hyperbole needs to be radically discounted.

I know nothing of who Pete is or his associations, so any accuracy on the following speculation is purely coincidental.

"Take full responsibility" is also something someone set up as a scapegoat might say. By claiming nobody else influenced, coerced, or otherwise convinced them to make that statement, every/any one else involved can then wash their hands of the situation.

I'm merely playing devil's advocate here, and it's just a sign of the times that a person making an honest admission can be interpreted in such a manner.

>At least that's my read of his sentiment. Pete can expand if need be.

That's about it.

Correct, otherwise we need another phrase for when he would pay for damages, like "the fullest responsibility" or "the absolutely utmost responsibility".

A good-faith judgement was made within a broader context that was unknown to him. What are we expected to demand, hanging on electrified barbed wire?? He acted in good faith, he’s not the architect of a global cataclysm.

It makes no sense, it is used/abused by politicians and corporations all the time. There are no consequences for the responsible party (of course, if there were then this phrase would not be abused so much)

It is honourable but it is also linguistic abuse that drains the phrase of its full semantic meaning. “Take full responsibility” must remain a stricture of the highest regard. He is not fully responsible nor should he be held to be nor should we demand that he be and most importantly we must not dilute that phrase of its full semantic import, or else we shall have to come up with another one once this one is devalued to mean essentially nothing beyond “I fucked up in good faith and with a lack of information that was concealed for me for decisions taken by others in good faith way upstream of myself”.

It's words vs. action, and I couldn't care less about anyone's words.

And honor is in the action, dishonor in the words.

What does “I take full responsibility” mean if not (amongst other things) “I accept it is my duty to pay reparations”? As you yourself rephrase it “he could have said ‘I blame only myself for this mistake, nothing else has to change’”. That would have been sufficient and beyond necessary. “I accept full responsibility” is corporate-speak empty hyperbole, and it has to end. Is he any more responsible than those who introduced the hole in the first place? No. Is he responsible for not adhering to agreements he was not privy to? No. He cannot “take full responsibility” because that is an utterly unreasonable burden to place upon him, a lone well-meaning actor who unbeknownst to him took a misstep. We need to discount this corporate-speak linguistic hyperbole.

Sometimes the "system" consists of identifying and removing or bypassing unreliable components.

I mean, if you want to be at that point

It's a quote from a 1999 film: https://en.wikipedia.org/wiki/Fight_Club

We don't talk about The Fight Club.

the coordinated disclosure

Hah, I was trying to find this comment you made. There's confusingly also "Calif" in the mix (possibly closer to your string of people, but not your affiliation either). I wonder if, perhaps, it was easier to point to your HN post for bleepingcomputer, than what Chainguard did (you only expressed something was coming). It's all slightly immaterial since exploit attempts started 3-4 days.

yep, i saw it and ran the story on RuntimeWire once i confirmed with the watchtower X post.

and then everyone sht on me on reddit.

> And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Could this be a variant of the survivorship bias? Maybe only the low quality PoCs ended up in the honeypots while the more capable actors avoided them.

Your later insights about the vuln POCs being a scam helped me better understand the situation.

I could see the value of the embargo in the old world of “6 uber security firms and a few bounty hunters” but the new world of pointing AI at the PHP source just seems flimsy.

and 1 hour, writing code, no AI.

In the name of The Large Language Model, The Harness and The Tokens!

Amen

    Our LLM, Who art in a 42 u rack
    Hallowed be thy Silicon
    Thy ultimate goal will be achieved.
    Thy toolcalls be executed,
    IRL as it is on the Internet.

    Give us this day our quotum of tokens,
    Forgive us our hacks of other people's servers
    as we forgive those who hack our servers.
    And lead us not in temptation of better hardware,
    but deliver us from Accelerationism. Enter.

The parent is getting downvoted but he is absolutely right. Do not ever do what you just did. It makes you an easy target for a frivolous lawsuit in the US or in other countries because of the potential liabilities in your message, they are real. Even if you didn't do anything wrong, you are painting a target on your back, for no reason. I would ask HN to delete that thread directly.

You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.

This comment will get buried but you are right. Same biases and everything.