5 ms·

>let's worry about that screw up after you get the remote code execution under control. Please confirm you understand this report. This is an awful vulnerabili

by tclancy 11y ago

>let's worry about that screw up after you get the remote code execution under control. Please confirm you understand this report. This is an awful vulnerability and their immediate attempts at mitigation are sad but I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. Not everyone working as a programmer is as good as you. Not everyone working as a programmer is any good. If you care about security here, why not concentrate on educating them. It's pretty likely the devs at any consumer hardware company aren't world-beaters; if we wanted that we would be willing to pay more than $100 for a router. It's also likely any large company has a chain of command these things have to go down through and back up again and for every link in that chain there's a greater than 0 chance the person has no idea about proper security. You may feel the security flaw is an obvious red flag that should have peoples' hair on fire but not everyone understands what you do.

paraxisi 11y ago
I agree with you with regards to the tone, but when your company description is "a global leader in internet content security software and cloud computing security with a focus on data security, virtualization, endpoint protection" (emphasis mine,) at some point somebody has to take some responsibility.
deleted 11y ago
[deleted]
drgath 11y ago
> but I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. To be accurate, that comment was from a security researcher at Google commenting on a closed-source software project. I agree that the tone of the comment was not beneficial, but I don't view it as being associated with or reflective of the open source community.
nezza-_- 11y ago
> If you care about security here, why not concentrate on educating them. They are selling a security product. They are the ones that should already know these things.
- tomku 11y ago
  To add on to this, by submitting the bug report, Tavis did not somehow magically become responsible for educating Trend Micro programmers about security.
pilif 11y ago
> Not everyone working as a programmer is as good as you. Not everyone working as a programmer is any good. sure. But then don't work on a security software suite. Or have bosses who properly code-review the commits. During the time this vulnerability existed, machines running TrendMicro were infinitely less secure than machines not running the security software. This is severely wrong and IMHO warrants the very harsh tone. This wasn't some obscure buffer overflow, sandbox escape vulnerability. This was running an RPC server over HTTP allowing full remote code execution over JSONp (or an <img> tag for that matter).
Matthias247 11y ago
I would agree with you if the software in question wasn't a pw manager. If you publish a software whose focus is security and show that you don't understand basic security issues then some direct words seem quite appropriate to me and the reaction from some [business] users might be much much harder.
detaro 11y ago
Not everybody has to catch those flaws. But if you are a security company and RELEASE that kind of crap, then it wasn't an instance of a poor guy new to security making a mistake, it is a catastrophic failure of your entire organization. Not properly fixing it means even after they were informed of the issue they weren't able to put people with the necessary skills on it. Which means either that the message didn't reach the appropriate people or that they don't employ enough of those. In both cases, you should not sell security products. This is no small bug that was overlooked in a code review. The pure idea of several things in it is so crazy that even suggesting them is a massive red flag. Actually implementing it?! If it goes through a chain of command, then ONE person realizing how bad this is should be enough. (Also, what "Open Source community"?)
tajen 11y ago
No. There's exactly 1 excuse for creating an API which exposes passwords and root execution: It's when it's secure to do it. And 0 excuse for the chain of command not understanding the product a company is building. I'm not saying we should tell off support people when this happen. But they have to show solidarity with customers whose security and privacy was exposed by accepting coarse language when it's there.
duaneb 11y ago
1) This is Google, not the open source community. 2) If you are releasing a security product you don't understand, this is worse than not releasing anything. Normally I'm with you, but this is security. If you need to educate them, __they should not be releasing software__. This is downright irresponsible and harmful. It's like attaching velcro to a door, calling it a lock, and selling it as a competitor to ACTUAL LOCKSMITHS.
- Smushman 11y ago
  'If you are releasing a security product you don't understand, this is worse than not releasing anything.' In a perfect world this would never happen... However we do not live in that perfect world. Far from it. The reality is all over the world and all of the time, software and a great many other things are designed and sold, and the person who 'knows how it all works' leaves. New people are hired. Some are good, and some are not. People quit, get illnesses, even die, and life goes on. When you solve ALL of those possible issues, then you can beat that drum all you want. Until then though, this comment is petty at best...
  - simoncion 11y ago
    > When you solve ALL of those possible issues, then you can beat that drum all you want. Until then though, this comment is petty at best... Would you say this in response to someone who harshly reprimanded the designer(s) and implementer(s) of the original Therac-25 control software? [0] If not, why not? [0] https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25
    - Smushman 11y ago
      Thanks for asking. In the case of danger/damage to human lives a la direct physical injury, there should be a much higher standard. It is why there exists murder in the first, second, or third degree; with very different punishments. There is a 'minimum standard' that must always be followed. I guess you will disagree, but to compare a programming design error in an antivirus product to the Therac incident falls outside normal deterministic logic, and would make actually my point. As someone who has made software for many years, it is not reasonable to expect a Therac or NASA level of diligence. This is what courts have upheld as well.
mrpippy 11y ago
> do itself a lot of favors by avoiding this kind of tone Honestly, I'm impressed that Tavis keeps the tone as professional as he does. This vulnerability and the AVG one from last month (https://news.ycombinator.com/item?id=10803467 https://news.ycombinator.com/item?id=10803467) are both head-slappingly stupid, just entire features that are ill-conceived and poorly implemented, and from software companies that should know better.
nkrisc 11y ago
Your points are valid if we're talking about a pull request on some amateur jQuery parallax effect plugin, not anti-virus software.
pbhjpbhj 11y ago
Are you trying to say it was a mistake that allowed the unsigned, non origin checked decryption and upload of all passwords. It looks much more like that was how they designed it. [IANA-Programmer FWIW] Also how is an origin check a fix. Like, great, now only Trend Micro (and any impersonators via DNS poisoning or similar tricks presumably) can read all my passwords in plain text?? >It's also likely any large company has a chain of command these things have to go down through and back up again and for every link in that chain there's a greater than 0 chance the person has no idea about proper security. // When the locks need changing in a school it doesn't matter that the headteacher has no idea how to fit a lock, nor what lock needs putting on which door; they have an employee who has some competency in the field (caretaker/janitor) sufficient to watch an outside expert (locksmith say) perform and certify the work. If the locksmith says "just paint the door with a brick pattern and don't bother with locks" then the janitor should realise that's not sufficient. >It's pretty likely the devs at any consumer hardware company aren't world-beaters // Trend Micro are a security software company, aren't they. From their website: "As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information. With over 25 years of security expertise, we’re recognized as the market leader in server security, cloud security, and small business content security." Like come on. "Global leaders in IT security" can tell exposing remote code exploits across your entire install base is worth paying a not-rubbish programmer to get here ASAP and fix your product.
Lawtonfogle 11y ago
Not every engineer is top of the line, so when the bridge fails we aren't doing ourselves a lot of favors by adopting a harsh tone. The truth is that technology has gotten to the point where poor security is lethal. From vehicles to medical devices, poor security can now allow a bad actor to put others into harms way. Now, mistakes happen. No one is perfect. But we should demand the adoption of systems that do their best to minimize the potential damage of human mistakes. Now, yelling at the construction worker because the bridge was poorly engineered is not at all effective. But the problem here isn't the tone, only that it need to be directed higher in the organization.
angersock 11y ago
You may feel the security flaw is an obvious red flag that should have peoples' hair on fire but not everyone understands what you do. Horseshit. Having a publically-exposed HTTP endpoint that enables arbitrary code execution is so goddamn stupid that even an intern with room-temperature intelligence should've been like "Hey, isn't this a possible vulnerability?" I'm all for the principle of charity, but if you are in a field where people are counting on you not to be a rank amateur then you better step up your game and not be surprised if they call you out on your incompetence. I'll humor a kid who screws up carving a turkey--but if they claim to be a neurosurgeon, they damned well better have a steady hand.
jacquesm 11y ago
I think the tone is actually quite restrained given the situation.
sarciszewski 11y ago
> I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. As someone who regularly discloses vulnerabilities in open source software, I respectfully disagree with this statement. You are, of course, welcome to have your own opinion.

by tclancy 11y ago

paraxisi 11y ago

I agree with you with regards to the tone, but when your company description is "a global leader in internet content security software and cloud computing security with a focus on data security, virtualization, endpoint protection" (emphasis mine,) at some point somebody has to take some responsibility.

deleted 11y ago

[deleted]

drgath 11y ago

> but I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. To be accurate, that comment was from a security researcher at Google commenting on a closed-source software project. I agree that the tone of the comment was not beneficial, but I don't view it as being associated with or reflective of the open source community.

nezza-_- 11y ago

> If you care about security here, why not concentrate on educating them. They are selling a security product. They are the ones that should already know these things.

tomku 11y ago
To add on to this, by submitting the bug report, Tavis did not somehow magically become responsible for educating Trend Micro programmers about security.

pilif 11y ago

> Not everyone working as a programmer is as good as you. Not everyone working as a programmer is any good. sure. But then don't work on a security software suite. Or have bosses who properly code-review the commits. During the time this vulnerability existed, machines running TrendMicro were infinitely less secure than machines not running the security software. This is severely wrong and IMHO warrants the very harsh tone. This wasn't some obscure buffer overflow, sandbox escape vulnerability. This was running an RPC server over HTTP allowing full remote code execution over JSONp (or an <img> tag for that matter).

Matthias247 11y ago

I would agree with you if the software in question wasn't a pw manager. If you publish a software whose focus is security and show that you don't understand basic security issues then some direct words seem quite appropriate to me and the reaction from some [business] users might be much much harder.

detaro 11y ago

Not everybody has to catch those flaws. But if you are a security company and RELEASE that kind of crap, then it wasn't an instance of a poor guy new to security making a mistake, it is a catastrophic failure of your entire organization. Not properly fixing it means even after they were informed of the issue they weren't able to put people with the necessary skills on it. Which means either that the message didn't reach the appropriate people or that they don't employ enough of those. In both cases, you should not sell security products. This is no small bug that was overlooked in a code review. The pure idea of several things in it is so crazy that even suggesting them is a massive red flag. Actually implementing it?! If it goes through a chain of command, then ONE person realizing how bad this is should be enough. (Also, what "Open Source community"?)

tajen 11y ago

No. There's exactly 1 excuse for creating an API which exposes passwords and root execution: It's when it's secure to do it. And 0 excuse for the chain of command not understanding the product a company is building. I'm not saying we should tell off support people when this happen. But they have to show solidarity with customers whose security and privacy was exposed by accepting coarse language when it's there.

duaneb 11y ago

1) This is Google, not the open source community. 2) If you are releasing a security product you don't understand, this is worse than not releasing anything. Normally I'm with you, but this is security. If you need to educate them, __they should not be releasing software__. This is downright irresponsible and harmful. It's like attaching velcro to a door, calling it a lock, and selling it as a competitor to ACTUAL LOCKSMITHS.

Smushman 11y ago
'If you are releasing a security product you don't understand, this is worse than not releasing anything.' In a perfect world this would never happen... However we do not live in that perfect world. Far from it. The reality is all over the world and all of the time, software and a great many other things are designed and sold, and the person who 'knows how it all works' leaves. New people are hired. Some are good, and some are not. People quit, get illnesses, even die, and life goes on. When you solve ALL of those possible issues, then you can beat that drum all you want. Until then though, this comment is petty at best...
- simoncion 11y ago
  > When you solve ALL of those possible issues, then you can beat that drum all you want. Until then though, this comment is petty at best... Would you say this in response to someone who harshly reprimanded the designer(s) and implementer(s) of the original Therac-25 control software? [0] If not, why not? [0] https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25
  - Smushman 11y ago
    Thanks for asking. In the case of danger/damage to human lives a la direct physical injury, there should be a much higher standard. It is why there exists murder in the first, second, or third degree; with very different punishments. There is a 'minimum standard' that must always be followed. I guess you will disagree, but to compare a programming design error in an antivirus product to the Therac incident falls outside normal deterministic logic, and would make actually my point. As someone who has made software for many years, it is not reasonable to expect a Therac or NASA level of diligence. This is what courts have upheld as well.

mrpippy 11y ago

> do itself a lot of favors by avoiding this kind of tone Honestly, I'm impressed that Tavis keeps the tone as professional as he does. This vulnerability and the AVG one from last month (https://news.ycombinator.com/item?id=10803467 https://news.ycombinator.com/item?id=10803467) are both head-slappingly stupid, just entire features that are ill-conceived and poorly implemented, and from software companies that should know better.

nkrisc 11y ago

Your points are valid if we're talking about a pull request on some amateur jQuery parallax effect plugin, not anti-virus software.

pbhjpbhj 11y ago

Are you trying to say it was a mistake that allowed the unsigned, non origin checked decryption and upload of all passwords. It looks much more like that was how they designed it. [IANA-Programmer FWIW] Also how is an origin check a fix. Like, great, now only Trend Micro (and any impersonators via DNS poisoning or similar tricks presumably) can read all my passwords in plain text?? >It's also likely any large company has a chain of command these things have to go down through and back up again and for every link in that chain there's a greater than 0 chance the person has no idea about proper security. // When the locks need changing in a school it doesn't matter that the headteacher has no idea how to fit a lock, nor what lock needs putting on which door; they have an employee who has some competency in the field (caretaker/janitor) sufficient to watch an outside expert (locksmith say) perform and certify the work. If the locksmith says "just paint the door with a brick pattern and don't bother with locks" then the janitor should realise that's not sufficient. >It's pretty likely the devs at any consumer hardware company aren't world-beaters // Trend Micro are a security software company, aren't they. From their website: "As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information. With over 25 years of security expertise, we’re recognized as the market leader in server security, cloud security, and small business content security." Like come on. "Global leaders in IT security" can tell exposing remote code exploits across your entire install base is worth paying a not-rubbish programmer to get here ASAP and fix your product.

Lawtonfogle 11y ago

Not every engineer is top of the line, so when the bridge fails we aren't doing ourselves a lot of favors by adopting a harsh tone. The truth is that technology has gotten to the point where poor security is lethal. From vehicles to medical devices, poor security can now allow a bad actor to put others into harms way. Now, mistakes happen. No one is perfect. But we should demand the adoption of systems that do their best to minimize the potential damage of human mistakes. Now, yelling at the construction worker because the bridge was poorly engineered is not at all effective. But the problem here isn't the tone, only that it need to be directed higher in the organization.

angersock 11y ago

You may feel the security flaw is an obvious red flag that should have peoples' hair on fire but not everyone understands what you do. Horseshit. Having a publically-exposed HTTP endpoint that enables arbitrary code execution is so goddamn stupid that even an intern with room-temperature intelligence should've been like "Hey, isn't this a possible vulnerability?" I'm all for the principle of charity, but if you are in a field where people are counting on you not to be a rank amateur then you better step up your game and not be surprised if they call you out on your incompetence. I'll humor a kid who screws up carving a turkey--but if they claim to be a neurosurgeon, they damned well better have a steady hand.

jacquesm 11y ago

I think the tone is actually quite restrained given the situation.

sarciszewski 11y ago

> I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. As someone who regularly discloses vulnerabilities in open source software, I respectfully disagree with this statement. You are, of course, welcome to have your own opinion.