5 ms·
This certainly isn't the first time a company has stifled publications pointing out flaws in its product. It's important to note that the reason many people in
by david_shaw 11y ago
This certainly isn't the first time a company has stifled publications pointing out flaws in its product. It's important to note that the reason many people in the security community are so upset is that FireEye, as a security company, "should know better."
The common best practice for security researchers is, when a vulnerability is discovered, to contact the organization with the vulnerable product, give them a set amount of time to fix/patch the issue (usually 60 or 90 days), and then release the vulnerability to the public after that amount of time has passed. Many people feel that this system holds organizations accountable, and makes it so that they can't simply ignore the issue -- without being punitive to the product and its users.
While people can certainly have different opinions on how FireEye is perceived, it's absolutely a major player in the security industry. For an organization such as that to stifle researchers is very surprising to many people in the community.
- kiliancs 11y agoStill, if the researcher releases IP together with the vulnerability, it seems legitimate for the IP owner to defend itself.
- david_shaw 11y agoYeah, I agree with you -- and that's where the conflicting messages seem to start. FireEye claims that they don't take issue with the vulnerability disclosure, just the IP publication; meanwhile, ERNW claims that they promised not to release any IP without FireEye approval, and that they never intended to release anything that would relate to IP. It's a weird situation.
- hga 11y agoDepends on whether the IP claims are valid. ERNW isn't saying anything about being provided IP by FireEye, which also sounds unlikely. And what IP could it be? Going from US law, none of trademark (they aren't pretending to be FireEye), trade secret (if FireEye revealed any without NDAs etc. they no longer are), or patents (publicly disclosed, their reason for existence in the US at least) would seem to apply. If they got source code, this would be going rather differently. Maybe reverse engineering law is different in Germany? Or ... well, let me just say I wouldn't be inclined to buy anything from the company after looking at that picture of the CEO, I've seen and interacted with that type way too many times.
- tomjen3 11y agoIt seems safer to just publish the security vuln openly and completely, without giving the company that owns it advance warning.