I am truly sorry. I take full responsibility for my actions.
It was not remotely my intention to cause any of the subsequent side effects.
At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
That clearly backfired in a pretty wild fashion. I have learned my lesson.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
Reality is that everyone has to make decisions in finite time, using the resources they actually have.
And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.
100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.
(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)
I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.
Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.
That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.
re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.
But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.
Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.
I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.
Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.
Honestly though, dont beat yourself up over this.
i forget the origin of the story, but i loosely remember a story about a boss and employee in a similar situation. the important bit was the bosses line ($ adjusted to match your story):
"why would i fire you when i just spent $250k training you"
> Any fool can criticize, condemn, and complain—and most fools do.
> But it takes character and self-control to understand and forgive.
> “A great man shows his greatness,” said Carlyle, “by the way he treats little men.”
> Bob Hoover, a famous test pilot and frequent performer at air shows, was returning to his home in Los Angeles from a show in San Diego. As described in the magazine Flight Operations, at three hundred feet in the air, both engines suddenly stopped. By deft maneuvering he managed to land the plane. It was badly damaged, but fortunately neither he nor his two passengers were hurt.
> Hoover’s first act after the emergency landing was to inspect the airplane’s fuel. Just as he suspected, the World War II propeller plane he had been flying had been loaded with jet fuel rather than gasoline.
> Upon returning to the airport, Hoover asked to see the mechanic who had serviced his airplane. The young man was sick with the agony of his mistake. Tears streamed down his face as Hoover approached. He had just caused the loss of a very expensive plane and could have caused the loss of three lives, as well.
> You can imagine Hoover’s anger. One could anticipate the tongue-lashing that this proud and precise pilot was about to unleash for that carelessness. But Hoover didn’t scold the mechanic; he didn’t even criticize him. Instead, he put his big arm around the man’s shoulder and said, “To show you I’m sure that you’ll never do this again, I want you to service my F51 tomorrow.”
however, it's much the same in spirit as the one you posted, thanks!
Aside from Pete's reply (see adjacent comment), I'd add that him taking full responsibility is also his way of saying his post was nobody else's fault but his.
In other words it's less about forfeiting assets and descendant peonage, and more about saying "the buck stops with me".
At least that's my read of his sentiment. Pete can expand if need be.
"Take full responsibility" is also something someone set up as a scapegoat might say. By claiming nobody else influenced, coerced, or otherwise convinced them to make that statement, every/any one else involved can then wash their hands of the situation.
I'm merely playing devil's advocate here, and it's just a sign of the times that a person making an honest admission can be interpreted in such a manner.
I'm not a scapegoat. Aside from a few brusque messages and a few people from my past finding me on LinkedIn, I've heard nothing from anyone.
I've seen my HN username mentioned on various outlets, and That Post© has been linked from a Wikipedia article, so I can chalk this up to experience. My fear (?) is that HN would get a reputational clobbering from me 'leaking', but given the other moving parts in this whole event I probably shouldn't be too concerned.
It's been a while since I've been involved in an international event, I'm a bit rusty on it!
That's about it. Mea culpa.
Could have said "I blame only myself for this mistake, nothing else needs to change".
This will keep happening until the system where this can happen runs out of willing scapegoats.
I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).
Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?
Flame on!
Today's PHP security release, and how we're strengthening security
Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.
In plain english, please.
Whether someone just leaked the CVE numbers or just ”there is a big bug in PHP” - that should not be enought to accelerate finding that bug. But other information that pins the bug for specific property or feature makes it easier to find and race against patching starts.
And at that point you don’t really know if someone really found it or not, since only few big organisations can collect that much data to detect successful exploiting. And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.
Until there is absolute evidence that exploitation happens in the wild, succesfully, you don’t leak the patch or bug details beforehand.
In this case, the area where the bug is in PHP, leaked partially, but apparently there was no enough evidence that it was exploited succesfully or if any of the PoCs in the wild actually worked properly. So patch or related detailed information was not released before the initial schedule.
Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters
You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.
https://med.stanford.edu/news/all-news/2017/10/in-patient-in...
> New research shows that discussing hospital errors with patients leads to better patient safety without spurring a barrage of malpractice claims.
No it doesn't have anything to do with what I said. The OP has no contractual or legal obligations toward any community, unlike a doctor and their patients in case of medical error.
edit:
> A doctor has no contractual obligation to apologize, either.
> But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.
OP isn't a doctor as far as you know, and isn't apologizing to a specific person. OP can't be bound to an embargo he didn't know about and wasn't involved in any decisions.
You're completely off topic and you just want the last word.
Your ramblings have nothing to do with anything I have said.
People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.
> Anyone can sue anyone else for any reason.
And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.
this whole saga will be analyzed and we'll all come out better for it at the end.
the embargo was already broken when pete received the information.
For the law, you can say that the law has been published and is at least available for review.