Oddbean new post about login | logout I hear ya, but white hat usually privately discloses vulnerabilities don't they?
That is true. Let’s say for one second it’s white hat, they would have disclosed privately like you said. So the general public wouldn’t be aware. Also maybe the relay operators didn’t find the definitive “cure” yet. Or it’s not white hat