7 ms·
Responsible disclosure involves notifying the vendor (Apple) first. https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsi
by zxv 11y ago
Responsible disclosure involves notifying the vendor (Apple) first.
https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
If the FBI wanted to protect the public, responsible disclosure of the exploit is a first step.
Sigh.
- coderdude 11y agoResponsible disclosure isn't the FBI's most effective way of protecting the public.
- CiPHPerCoder 11y agoAs much as I'm inclined to agree with this line of argument in this particular case, I do take issue with the term "responsible disclosure" for many of the reasons outlined here: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is...
- wcummings 11y agoI don't like what the FBI has done, but I'll say what I always say when "responsible" disclosure comes up, for consistency. Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has.
- hueving 11y agoWeapons are also valuable, that doesn't give you a free pass to sell arms to gangs.
- wcummings 11y agoTreating "hacking tools" like weapons is a terrible idea. This is the flawed thinking behind the Waasenaar Agreement.
- hueving 11y agoIf hacking tools didn't facilitate access to industrial control systems, personal health and financial information, private communications and photos, then I would probably agree. A vulnerability in a criminals hands leads to very real life damages.
- cmdrfred 11y agoThe issue is with the software the has a vulnerability not the software that exploits it. It would be fine to sell gangs guns if we could patch that pesky 'bullets kill humans' bug.
- justratsinacoat 11y agoIt seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.
- derefr 11y agoOther similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
- profeta 11y agoCode is not a weapon. bad analogy. Also, LA gangs used EV cars for modern drive-by's. Should EV cars now have a "gun tax"?
- droopybuns 11y agoWassenaar would not exist if you were correct. https://en.wikipedia.org/wiki/Wassenaar_Arrangement https://en.wikipedia.org/wiki/Wassenaar_Arrangement
- hueving 11y agoWhat destroyed the enrichment devices in Iran then?
- 98216381 11y agoThe incompetence of the operators of the devices.
- calgoo 11y agoHackers and state actors. Whatever tools the used where just that. If someone uses a wrench destroy the enrichment devices, did the wrench destroy the device or the person using it?
- hueving 11y agoIf they used a bomb to destroy it, we'd still classify the bomb as a weapon regardless of whether you say the bomb destroyed it or the bomber.
- Dylan16807 11y agoBut if they had started flipping the power switch rapidly we wouldn't call the power switch a weapon. You can destroy a lot of devices that way.
- hueving 11y ago
- bcook 11y agoDefine "value".
- roel_v 11y agoSo you're advocating a permit system for, say, having a copy of nmap? Don't tell me we need to go back to that discussion again?
- hueving 11y agoNo, 'nmap' is not a vulnerability. I'm advocating to hold people responsible that sell vulnerabilities to the highest bidder under the full knowledge that the bidder will not tell the manufacturer and will use it for nefarious purposes. It's nearly impossible to enforce something like this because of anonymous markets and crypto currencies, but we should at least shame people that advocate for it or admit to doing it.
- dogma1138 11y agoNmap has modules that can detect and exploit basic and often old vulnerabilities.
- roel_v 11y agoWhat we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).
- pjc50 11y agoIt does if you're the FBI: https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal
- rlpb 11y agoSelling arms solely to law enforcement, however, sounds reasonable.
- AnthonyMouse 11y ago> Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has. This seems a lot like saying, if someone pays you to do a structural analysis of a parking garage because they want to know if they can profit by shorting the company that owns it, and you discover that the garage is likely to collapse, you don't have any obligation to disclose the vulnerability.
- ikeboy 11y agoThe garage will hurt people when it collapses.
- jarcane 11y agoAre you implying that compromised security is harmless?
- ikeboy 11y agoIt doesn't represent imminent physical danger, so the analogy fails.
- heartsucker 11y agoWhat about the hackers who remotely stopped a Jeep on the freeway? I'm pretty sure that's "imminent physical danger."
- ikeboy 11y agoAnd the reaction on HN at the time was very critical. Iirc they disclosed it to the company soon enough, but I would certainly be upset if they auctioned it to the highest bidder.
- pdkl95 11y agoWhat magic are you using to predict that this communication tool is never be used by someone in "imminent physical danger"? Depending on how this exploit works, a simple denial of service when someone needs to call for emergency services may indeed represent an "imminent physical danger". People rely heavily on their phones, both for connectivity and to store important information. As this reliance increases in the future, the probability of a phone being part of a life threatening situation will approach one.
- williamcotton 11y agoApple used the FBI hearings as a public relations project. They lost all sympathy from the Feds after that. They really should have played their card differently but instead wanted to rally the public against a federal law enforcement agency so they can prove to customers that they take privacy seriously. I'm not sure if Apple intended to rile up the Snowden/tin-hat wearing crowd who thinks the government is out to get everyone, but that sure didn't leave a nice aftertaste in the FBI's mouth. Looking at this objectively, Apple shouldn't expect the curtesy of responsible disclosure. If this makes the public wary of Apple ability to protect their privacy, well, so be it. The FBI's duty is to actually protect the public, not to protect the customers of a single corporation. I think this is brilliant counter-marketing on the part of the FBI and a real "fuck you" to Apple for turning a criminal investigation of a mass murder in to some fucking sideshow circus where they could show the public just how much more they care about privacy than the government. EDIT: I'm sorry, but I have a rate limited account because my conservative opinions are not valued by the HackerNews community. I have some follow ups to your comments: --- > That includes protecting the public's communication from criminal eavesdropping, which they are undermining when they keep an exploit secret instead of responsibly disclosing it. I'm sorry, but this is not how the courts see things. Please see https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine As far as I'm concerned and as far as the US government is concerned, as soon as you broadcast radio and electrical signals from your private person or property, it's been published. That's how it's been since the beginning of the country and that why Apple and Facebook are even allowed to sell your information to third-party marketers. Everything that leaves your devices legally has to be made public so our data can be legally sold. This is also related to credit reports, doing-business-as, and many other kinds of public record keeping. You should not expect privacy when buying and selling goods in a public marketplace. How could you possible stop someone from monitoring what you're buying and selling? Consumer reporting, public record keeping, and public census data are incredibly important parts of our institutions. We're going to need a newly defined set of laws and regulations to actual define what I've been calling "privished" works, that is, information that a third-party is liable to both the individual as well as the government, to make sure that the 4th amendment is still a two-way contract. I suggest you brush up on some of your constitutional and common law interpretations of what privacy actually means with regards to mass communication. I think most of the HN threads are missing half of the social contract and fail to see the importance of granting the government the right to warranted search and seizure.
- na85 11y agoI'm shocked to know that people still think law enforcement wants to protect the public.
- huuu 11y agoWhat exploit? From the article: "... according to people familiar with the matter." There is absolutely no proof of an exploit here. There are a lot of people 'familiar with the matter' that talk BS. For example I heard some expert say that they just bought 1000 iPhones and copied the ROM on each phone to try each pin combination. Edit: to be clear: I'm talking about a software exploit. I think it's more likely the phone was cracked via a hardware exploit.
- spacecowboy_lon 11y agoWould not the FBI and the Subcontractor be bound by the US version of the offical secrets act.
- ryanlol 11y agoResponsible disclosure, despite it's name is often not the most responsible course of action to take. And in any case, what does the FBI even have to disclose here? An exploit that they may or may not have that wold undoubtedly be contractually obligated not to share. In any case, everyone already knew that the crypto on that particular iPhone model was broken.
- lawnchair_larry 11y agoThe industry has rejected and abandoned the term "responsible disclosure". Like most cases, it doesn't make any sense here.