{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2022:LJWOMI6PQVFVDXPPFXL2Y5WF5T","short_pith_number":"pith:LJWOMI6P","schema_version":"1.0","canonical_sha256":"5a6ce623cf854b51ddef2dd7ac76c5ecc090f60a9fa423d551fd0a53e3a59041","source":{"kind":"arxiv","id":"2209.10717","version":1},"attestation_state":"computed","paper":{"title":"Talking Trojan: Analyzing an Industry-Wide Disclosure","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Nicholas Boucher, Ross Anderson","submitted_at":"2022-09-22T00:53:04Z","abstract_excerpt":"While vulnerability research often focuses on technical findings and post-public release industrial response, we provide an analysis of the rest of the story: the coordinated disclosure process from discovery through public release. The industry-wide 'Trojan Source' vulnerability which affected most compilers, interpreters, code editors, and code repositories provided an interesting natural experiment, enabling us to compare responses by firms versus nonprofits and by firms that managed their own response versus firms that outsourced it. We document the interaction with bug bounty programs, go"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2209.10717","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2022-09-22T00:53:04Z","cross_cats_sorted":[],"title_canon_sha256":"daef96ca0381ec2364b9af4fbf5793f09b1f2d60d60041dc77d65291dab12bb4","abstract_canon_sha256":"bcde4c13f24d725b536240e22800e807aa6da2235faa1e528dbfb49ef342f2e4"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:00:05.626155Z","signature_b64":"Ak5xqzdJDO0xFONUrOwx1eAzrgKzAdZfr48DPGKENi3bYNadyz56VMALMkRk5P7qlF5kmX7X3gRDiif9SdfsDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5a6ce623cf854b51ddef2dd7ac76c5ecc090f60a9fa423d551fd0a53e3a59041","last_reissued_at":"2026-07-05T05:00:05.625759Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:00:05.625759Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Talking Trojan: Analyzing an Industry-Wide Disclosure","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Nicholas Boucher, Ross Anderson","submitted_at":"2022-09-22T00:53:04Z","abstract_excerpt":"While vulnerability research often focuses on technical findings and post-public release industrial response, we provide an analysis of the rest of the story: the coordinated disclosure process from discovery through public release. The industry-wide 'Trojan Source' vulnerability which affected most compilers, interpreters, code editors, and code repositories provided an interesting natural experiment, enabling us to compare responses by firms versus nonprofits and by firms that managed their own response versus firms that outsourced it. We document the interaction with bug bounty programs, go"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2209.10717","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2209.10717/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2209.10717","created_at":"2026-07-05T05:00:05.625824+00:00"},{"alias_kind":"arxiv_version","alias_value":"2209.10717v1","created_at":"2026-07-05T05:00:05.625824+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2209.10717","created_at":"2026-07-05T05:00:05.625824+00:00"},{"alias_kind":"pith_short_12","alias_value":"LJWOMI6PQVFV","created_at":"2026-07-05T05:00:05.625824+00:00"},{"alias_kind":"pith_short_16","alias_value":"LJWOMI6PQVFVDXPP","created_at":"2026-07-05T05:00:05.625824+00:00"},{"alias_kind":"pith_short_8","alias_value":"LJWOMI6P","created_at":"2026-07-05T05:00:05.625824+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T","json":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T.json","graph_json":"https://pith.science/api/pith-number/LJWOMI6PQVFVDXPPFXL2Y5WF5T/graph.json","events_json":"https://pith.science/api/pith-number/LJWOMI6PQVFVDXPPFXL2Y5WF5T/events.json","paper":"https://pith.science/paper/LJWOMI6P"},"agent_actions":{"view_html":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T","download_json":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T.json","view_paper":"https://pith.science/paper/LJWOMI6P","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2209.10717&json=true","fetch_graph":"https://pith.science/api/pith-number/LJWOMI6PQVFVDXPPFXL2Y5WF5T/graph.json","fetch_events":"https://pith.science/api/pith-number/LJWOMI6PQVFVDXPPFXL2Y5WF5T/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T/action/timestamp_anchor","attest_storage":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T/action/storage_attestation","attest_author":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T/action/author_attestation","sign_citation":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T/action/citation_signature","submit_replication":"https://pith.science/pith/LJWOMI6PQVFVDXPPFXL2Y5WF5T/action/replication_record"}},"created_at":"2026-07-05T05:00:05.625824+00:00","updated_at":"2026-07-05T05:00:05.625824+00:00"}