Reply to thread

Message

<blockquote data-quote="Dysfunction" data-source="post: 1643759" data-attributes="member: 51052">The BASH fix was rolled out for OS X within a week..&nbsp; <img src="/mac_images/images/smilies/Innocent.png"&nbsp; class="smilie" loading="lazy" alt="O:)" title="Innocent&nbsp; &nbsp; O:)" data-shortname="O:)" /> So, that's really not that slow if you allow for testing (and you'd be pretty unhappy if these things were simply risk-assessed and released, I believe)12 September 2014 - reported to BASH maintainers24 September 2014 - disclosed publicly (verification does need to occur)29 September 2014 - patch available as OS X bash Update 1.0Now, the problem:So we have a situation where a standardized shell is vulnerable, this needs to be communicated to those who use the shell. This is done publicly, which is the most efficient and transparent option. The problem with this is, as soon as the vulnerability was communicated, thousands of botnets were generated to take advantage of it. How do we make this information available without alerting those who would utilize it? Fundamentally, this is a large question.</blockquote>

[QUOTE="Dysfunction, post: 1643759, member: 51052"] The BASH fix was rolled out for OS X within a week.. O:) So, that's really not that slow if you allow for testing (and you'd be pretty unhappy if these things were simply risk-assessed and released, I believe) 12 September 2014 - reported to BASH maintainers 24 September 2014 - disclosed publicly (verification does need to occur) 29 September 2014 - patch available as OS X bash Update 1.0 Now, the problem: So we have a situation where a standardized shell is vulnerable, this needs to be communicated to those who use the shell. This is done publicly, which is the most efficient and transparent option. The problem with this is, as soon as the vulnerability was communicated, thousands of botnets were generated to take advantage of it. How do we make this information available without alerting those who would utilize it? Fundamentally, this is a large question. [/QUOTE]

Verification

Name this item. 🍎