4 ms·

> As usual, SEC Consult Vulnerability Lab communicated this issue according to our responsible disclosure policy. Initial contact and exchange of the security a

by finid 11y ago

> As usual, SEC Consult Vulnerability Lab communicated this issue according to our responsible disclosure policy. Initial contact and exchange of the security advisory was performed through the European sales team at AMX. My stance with these things, is if it's a backdoor, "responsible disclosure" is out the window. Just expose the criminal to the public.

Animats 11y ago
Agreed. It's amazing how many of these "backdoors" are showing up. Including ones which were obfuscated so as not to be visible to people reading the code. This is looking very suspicious. Why are are there no prosecutions under the Computer Fraud and Abuse Act, under the "exceeds authorized access" provision? In many cases, no EULA would get the vendor off the hook, because that doesn't help in criminal prosecutions. Also, the party spied upon may not be the one who bought the device or software, so they're not limited by the EULA.
- Drdrdrq 11y ago
  Nitpick: EULA usually applies to end user, not buyer (hence the name). Agree otherwise.
pavel_lishin 11y ago
> My stance with these things, is if it's a backdoor, "responsible disclosure" is out the window. Responsible disclosure doesn't just protect the company who built the product; it also protects all the people who bought it.
- throwaway2048 11y ago
  unless of course bad people are abusing it (they are smart enough to find these things too)
  - pavel_lishin 11y ago
    But not 100% of the potential abusers will know about the backdoor. By disclosing irresponsibly, you're making an actual attack much more likely, since now theoretically every bad actor now knows about it.
    - throwaway2048 11y ago
      you have no way to quantify those numbers, "irresponsible disclosure" is frankly, just a bullshit term.
      - pavel_lishin 11y ago
        > you have no way to quantify those number Neither do you, therefore we're just having a bullshit argument.

by finid 11y ago

Animats 11y ago

Agreed. It's amazing how many of these "backdoors" are showing up. Including ones which were obfuscated so as not to be visible to people reading the code. This is looking very suspicious. Why are are there no prosecutions under the Computer Fraud and Abuse Act, under the "exceeds authorized access" provision? In many cases, no EULA would get the vendor off the hook, because that doesn't help in criminal prosecutions. Also, the party spied upon may not be the one who bought the device or software, so they're not limited by the EULA.

Drdrdrq 11y ago
Nitpick: EULA usually applies to end user, not buyer (hence the name). Agree otherwise.

pavel_lishin 11y ago

> My stance with these things, is if it's a backdoor, "responsible disclosure" is out the window. Responsible disclosure doesn't just protect the company who built the product; it also protects all the people who bought it.

throwaway2048 11y ago
unless of course bad people are abusing it (they are smart enough to find these things too)
- pavel_lishin 11y ago
  But not 100% of the potential abusers will know about the backdoor. By disclosing irresponsibly, you're making an actual attack much more likely, since now theoretically every bad actor now knows about it.
  - throwaway2048 11y ago
    you have no way to quantify those numbers, "irresponsible disclosure" is frankly, just a bullshit term.
    - pavel_lishin 11y ago
      > you have no way to quantify those number Neither do you, therefore we're just having a bullshit argument.