> We knew we had to fix joi to prevent this but given the scale of this issue, we had to do it in a way that will put a fix out without drawing too much attention to it — without making it too easy to exploit — at least for a few days until most systems received the update.
> Sneaking a fix isn't the hardest thing to accomplish. If you combine it with an otherwise purposeless refactor of the code, and throw in a few unrelated bug fixes and maybe a cool new feature, you can publish a new version without drawing attention to the real issue being fixed.
Jesus. That is not how vulnerability disclosure and zero-day management work in most projects for very, very good reasons.
If you're considering "sneaking out" a fix as part of a larger bundle of redactors, don't. Notify your users and prominent dependent projects, agree (with adults in the room) on how and where you'll perform coordinated disclosure, and take your lumps. To do otherwise is to basically guarantee that larger numbers of bad actors will be exploiting your issue earlier and in worse ways than you could imagine.
> Sneaking a fix isn't the hardest thing to accomplish. If you combine it with an otherwise purposeless refactor of the code, and throw in a few unrelated bug fixes and maybe a cool new feature, you can publish a new version without drawing attention to the real issue being fixed.
Jesus. That is not how vulnerability disclosure and zero-day management work in most projects for very, very good reasons.
If you're considering "sneaking out" a fix as part of a larger bundle of redactors, don't. Notify your users and prominent dependent projects, agree (with adults in the room) on how and where you'll perform coordinated disclosure, and take your lumps. To do otherwise is to basically guarantee that larger numbers of bad actors will be exploiting your issue earlier and in worse ways than you could imagine.