CHEF-KOCH

You got busted that you lied. How is that slander if is true.

Why not address this, create another post answer and respond to it. I was not involved in all of this and do not care much about this at all, my opinion on PCIO, GrapheneOS is well-known.

I have not checked all points but OP has some valid points, if you like it or not.

Blocked you know, you can do the same. But do not call me someone who slander others, this is seriously not the case, I at worst mock them, but this is well-known.

That is all I am going to say here.

It is not really slandering. If you check their statements regarding developers, they deserve much worse. If I would leak what they said on Reddit and via Reddit DM, that would be slandering, even if it is true.

Edit… really… 😂

👇😂

PrivacyClowns are amateurs.

Skip them and follow me, you learn much more within 1 week or money back… kek. I do not censor legit submissions, never have, and never will.

Mirrored your post 🤗.

We have already systems to notify users.

• Most IT Professionals are aware that Kerberos, SMB and Co. is a hole for issues, it is nothing new to them.
• We have social media, Reddit or your linked HN Website, what makes you think people are faster submitting new stuff to GitHub, well there is no difference, if you post it on Twitter, GitHub or what, people need to find that first.
• We already have CVE databases you can look up for years.
• On huge events, even TV news will do.
• People exploit the moment the ghost is out of the bottle, it is all about preventation as well as management. News alone is not enough.
• Notify users about each new attack and leak will result that people care less because they feel helpless and think … oh okay, just another daily attack.
• Log4j was over-hyped, like most things, most software that normal people use like Browser were never affected, using a hyped problem as example how slow something is, is seriously no real argument because IT-Professionals need time to review the findings before coming to conclusions.
• High reputation software such as Thunderbird are less to be affected, because they patch things first, they have huge user-base. You see this in every changelog when they fix security issues.
• Saying that SMS or what is maybe expensive is weird, if you target professionals, no professional will reg via SMS or in other words his phone number. Typical use case is RSS which is cheap.
• There are 0-days sold on the black market that are being used for months, you never hear from them and they have much bigger impact, usually because people who code them keep their source closed or even if they sell them, people have no interest to pay a lot of money and then leak it for free to the public, in most scenarios, there are white-hats of course, they abuse it. The argumentation that just because something is out for hours is unprofessional. Google, MS etc. have disclose time between 60 and 90 DAYS before they do something.

I like that you try to do something, but it would be better joining existent solutions instead of creating another services that might vanish into the void like half of the rest who tried. GitHub is also pretty unchill regarding malware, if you post something that can directly used to exploit GitHub or others, they will close your repo without any warning in advance.

If your target are admins then consider making this more clear, otherwise people will use this information and use it to exploit others.

Bugalert does not look so hot …