5 ms·

I see you point about it being overly difficult to report vulnerabilities, especially legal threats, that seriously sucks. I guess I believe you have an obligat

I see you point about it being overly difficult to report vulnerabilities, especially legal threats, that seriously sucks. I guess I believe you have an obligation to make some effort to disclose, but if a project is just irresponsible and won't fix their shit, or will try to sue you, it's out of your hands.

tptacek 10y ago
Somehow my doing work on my own time creates an obligation for me to do more work on behalf of others. Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? If you started looking, you'd find some. Why do you get to free-ride on my work by refusing to scrutinize the stuff you run?
- openasocket 10y ago
  > Somehow my doing work on my own time creates an obligation for me to do more work on behalf of others. To some small extent, yes, though how much work is up for debate. Maintainer's email and PGP public key is right there on the website? Yeah, I think you're obligated. No email you can find, no way to contact them, or are just outright hostile? No, I think you shouldn't have to deal with that. But I feel like you agree with that, though maybe not in those exact words. After all, you've had to jump through all kinds of hoops to disclose vulnerabilities, been threatened with lawsuits for doing the right thing, and yet you still practice responsible disclosure in almost every case in spite of the burden of effort and potential risk. Aren't you doing it because you think disclosure is the right think to do? That's all I mean by obligation. EDIT: sorry, not "responsible disclosure," "cooperative disclosure" or whatever term you want to use for disclosing the vulnerability to the maintainer.
  - tptacek 10y ago
    I object strongly to your claim that I practice "responsible disclosure", for the reasons stated earlier in the thread.
  - lawnchair_larry 10y ago
    There is no such thing as responsible disclosure. The concept is nonsensical. Also, you're overestimating the consequences of a single bug. The boring reality is that bugs rarely matter.
  - danbruc 10y ago
    I think it is a matter of degree. Here - not sure how this is handled in other countries - it is a crime if you come across an accident and do not attempt to help. And to me this is obviously not only the right thing to do because it is required by law but because there is a moral obligation to do so. Nobody has to enter a burning car and risk his life but at least you have to call the emergency service or do whatever you can reasonably do to help. And it really doesn't matter whether you are doing your work delivering packages, whether the accident was the fault of the driver because he was driving intoxicated, if somebody else could also help or whatnot. Discovering a vulnerability is of cause different in most respects - the danger is less imminent, the vendor may have a larger responsibility and so on. But the basic structure is the same - more or less by accident you end up in a situation where there is a danger and you are in the position to help to make the outcome probably better. So I think one can not simply dismiss that there might be a moral obligation to disclose a vulnerability to the vendor on just the structure of the situation, one has to either argue that there is also no moral obligation in the accident scenario or argue that the details are sufficiently different that a different action - or no action in this specific case - is the morally correct or at least an morally acceptable action.
    - tptacek 10y ago
      Accidents and vulnerabilities are not directly comparable, so a position on vuln disclosure does not necessarily imply a particular position on accident assistance. I would feel a moral obligation to help mitigate concrete physical harm to victims of an accident. I feel no such obligation to protect against hypothetical threats to computer systems. Chances are, you recognize similar distinctions; for instance, I doubt you feel obligated to intervene in accidents that pose only minor personal property risks.
      - danbruc 10y ago
        That is also my point of view, severity and other factors matter. But that also seems to imply the same thing for vulnerabilities - discovering a remote code execution vulnerability in Windows might warrant a different action than a hidden master password in an obscure forum software no one really used in a decade. The danger is still more abstract but it can still cause real harm to real people.
  - woodman 10y ago
    When you say obligation, do you actually mean that? An obligation is enforced by some sort of penalty, either legal (ultimately a threat of violence) or social (public shaming). There is no incentive for meeting an obligation outside of avoiding punishment, so why would individuals and private enterprises do any infosec work?
- lawnchair_larry 10y ago
  This is a fascinating exchange. Now I wonder how much of the general population, or even the tech-but-not-security population thinks like this.
- big_surprise 10y ago
  You assume that your own research machine can't be compromised, nor are the communication channels of the organization at fault. So, it won't be fixed. Hopefully only one or two people know about the same flaw you found... Oh, but you would know ahead of time if concrete physical harm could possibly come to the victim of an accident? Well good for you! You should probably be in charge of defending all infosec research, since apparently you can't be hacked.
  - tptacek 10y ago
    Please do tell me about all the carnage you've averted by looking for, finding, and reporting vulnerabilities. Are there other slices of my time on this planet you also feel entitled to a share of? Would we all be better off if I went to work on a cat-sharing startup and spent all my spare time playing Dwarf Fortress? That way I wouldn't find anything, and you wouldn't have to worry about vulnerabilities anymore, right? I seriously don't understand the logic you're employing here.
    - big_surprise 10y ago
      Then you misunderstood your own logical conclusion... You said (and I quote): Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? No. No, you can't. Unless you could convince me that my Dwarf Fortress skills have a similar magnitude of real-world affect as the vulnerabilities I've discovered on my own and decided to pocket for one reason or another.
      - tptacek 10y ago
        By your logic, I am better off not doing vulnerability research in my spare time --- as is virtually everybody else. How is that a good outcome?
        big_surprise 10y ago
        No. By my logic, you are better off not doing vulnerability research in your spare time if you have to worry about the legal ramifications of your actions. The ethical conundrums are unavoidable, and those calculations are indeed difficult. The legal consequences are artifice, and by agreeing to those (while ignoring externalities and not going public), you are likely putting others at risk.

tptacek 10y ago

Somehow my doing work on my own time creates an obligation for me to do more work on behalf of others. Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? If you started looking, you'd find some. Why do you get to free-ride on my work by refusing to scrutinize the stuff you run?

openasocket 10y ago
> Somehow my doing work on my own time creates an obligation for me to do more work on behalf of others. To some small extent, yes, though how much work is up for debate. Maintainer's email and PGP public key is right there on the website? Yeah, I think you're obligated. No email you can find, no way to contact them, or are just outright hostile? No, I think you shouldn't have to deal with that. But I feel like you agree with that, though maybe not in those exact words. After all, you've had to jump through all kinds of hoops to disclose vulnerabilities, been threatened with lawsuits for doing the right thing, and yet you still practice responsible disclosure in almost every case in spite of the burden of effort and potential risk. Aren't you doing it because you think disclosure is the right think to do? That's all I mean by obligation. EDIT: sorry, not "responsible disclosure," "cooperative disclosure" or whatever term you want to use for disclosing the vulnerability to the maintainer.
- tptacek 10y ago
  I object strongly to your claim that I practice "responsible disclosure", for the reasons stated earlier in the thread.
- lawnchair_larry 10y ago
  There is no such thing as responsible disclosure. The concept is nonsensical. Also, you're overestimating the consequences of a single bug. The boring reality is that bugs rarely matter.
- danbruc 10y ago
  I think it is a matter of degree. Here - not sure how this is handled in other countries - it is a crime if you come across an accident and do not attempt to help. And to me this is obviously not only the right thing to do because it is required by law but because there is a moral obligation to do so. Nobody has to enter a burning car and risk his life but at least you have to call the emergency service or do whatever you can reasonably do to help. And it really doesn't matter whether you are doing your work delivering packages, whether the accident was the fault of the driver because he was driving intoxicated, if somebody else could also help or whatnot. Discovering a vulnerability is of cause different in most respects - the danger is less imminent, the vendor may have a larger responsibility and so on. But the basic structure is the same - more or less by accident you end up in a situation where there is a danger and you are in the position to help to make the outcome probably better. So I think one can not simply dismiss that there might be a moral obligation to disclose a vulnerability to the vendor on just the structure of the situation, one has to either argue that there is also no moral obligation in the accident scenario or argue that the details are sufficiently different that a different action - or no action in this specific case - is the morally correct or at least an morally acceptable action.
  - tptacek 10y ago
    Accidents and vulnerabilities are not directly comparable, so a position on vuln disclosure does not necessarily imply a particular position on accident assistance. I would feel a moral obligation to help mitigate concrete physical harm to victims of an accident. I feel no such obligation to protect against hypothetical threats to computer systems. Chances are, you recognize similar distinctions; for instance, I doubt you feel obligated to intervene in accidents that pose only minor personal property risks.
    - danbruc 10y ago
      That is also my point of view, severity and other factors matter. But that also seems to imply the same thing for vulnerabilities - discovering a remote code execution vulnerability in Windows might warrant a different action than a hidden master password in an obscure forum software no one really used in a decade. The danger is still more abstract but it can still cause real harm to real people.
- woodman 10y ago
  When you say obligation, do you actually mean that? An obligation is enforced by some sort of penalty, either legal (ultimately a threat of violence) or social (public shaming). There is no incentive for meeting an obligation outside of avoiding punishment, so why would individuals and private enterprises do any infosec work?
lawnchair_larry 10y ago
This is a fascinating exchange. Now I wonder how much of the general population, or even the tech-but-not-security population thinks like this.
big_surprise 10y ago
You assume that your own research machine can't be compromised, nor are the communication channels of the organization at fault. So, it won't be fixed. Hopefully only one or two people know about the same flaw you found... Oh, but you would know ahead of time if concrete physical harm could possibly come to the victim of an accident? Well good for you! You should probably be in charge of defending all infosec research, since apparently you can't be hacked.
- tptacek 10y ago
  Please do tell me about all the carnage you've averted by looking for, finding, and reporting vulnerabilities. Are there other slices of my time on this planet you also feel entitled to a share of? Would we all be better off if I went to work on a cat-sharing startup and spent all my spare time playing Dwarf Fortress? That way I wouldn't find anything, and you wouldn't have to worry about vulnerabilities anymore, right? I seriously don't understand the logic you're employing here.
  - big_surprise 10y ago
    Then you misunderstood your own logical conclusion... You said (and I quote): Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? No. No, you can't. Unless you could convince me that my Dwarf Fortress skills have a similar magnitude of real-world affect as the vulnerabilities I've discovered on my own and decided to pocket for one reason or another.
    - tptacek 10y ago
      By your logic, I am better off not doing vulnerability research in my spare time --- as is virtually everybody else. How is that a good outcome?
      - big_surprise 10y ago
        No. By my logic, you are better off not doing vulnerability research in your spare time if you have to worry about the legal ramifications of your actions. The ethical conundrums are unavoidable, and those calculations are indeed difficult. The legal consequences are artifice, and by agreeing to those (while ignoring externalities and not going public), you are likely putting others at risk.