pull down to refresh
Starting from late 2024, there's been a new rule: NEVER announce an embargo before you have the fix/binaries released. In 2026, this rule is harder and more necessary than ever before. I'm not going to explain why.
Not poking for explanations of the core message, but what do you mean by embargo in this context?
I am only aware of the word embargo in the context of not allowing a ship into (or out of) ports or, more generalized, trading with someone.
I don't understand how it fits in with the situation around CLN.
Oh embargo means you're for a limited time not disclosing what you're patching because it is sensitive.
What this rule means practically is: complete radio silence before you have your release ready for download. Work on a patch in silence. Release it. Do your announcement within minutes of publishing the release and as wide as possible - whatever your message is. Don't leak at any point that you're working on something, not even to the reporter.
Yeah, this is the part I hadn't really considered when writing it.
Announcing that something is wrong before operators actually have the binary changes the threat model by itself. You've basically told everyone where to start looking while defenders still have nothing to deploy.
So the 14-day embargo may not even be the most interesting part here. The timing of the announcement vs the availability of the fix might be.
Definitely something I'll revisit once the source drops. Thanks for adding this.
I wrote a full reply. Then I thought deeply about it before hitting
replyand took out everything that will just give a-holes ideas. Here's what's left:Starting from late 2024, there's been a new rule: NEVER announce an embargo before you have the fix/binaries released. In 2026, this rule is harder and more necessary than ever before. I'm not going to explain why.