The Security Online article only cites Margitelli’s post on the matter. My assumption has been the article used the post as its single source. On one hand, watching MS fuck shit up for years, I want to believe Margitelli. On the other hand, researchers using weird tools and uninterested in reality are why curl is now a CNA.
I’m personally frustrated with Margitelli’s post because it’s all about abandoning responsible disclosure globally rather than naming and shaming (Canonical? Red Hat? Both? Others? If it affects all GNU/Linux I’d expect every single distro maintainer to be named and shamed). Responsible disclosure is our best solution to make sure innocent bystanders don’t get caught in the crossfire. When specific entities don’t abide by responsible disclosure we lambast those specific entities not the entire process built to keep users safe.
This is actually true. Essentially a big drug manufacturer took down a scientist through a serious harassment campaign and blew him the fuck up when he finally snapped. In no large part to this coordinated glowup, published literature in the US agrees with the chemical manufacturer while it’s been banned in the EU for 20 years. The EPA might disagree with me that it’s true; the EPA and others funded in no small part by Syngenta refuse to look at things by Dr Hayes because he lost his cool a few times. Unfortunately Alex Jones further eroded the credibility of Dr Hayes but, imo, only because Syngenta actively deplatformed his research. Also Jones said some crazy shit about it.