43 ms·

You certainly know him better than most people on here, so I can appreciate your position and believe you when you say it. If that's the case, though, then he

by eganist 10y ago

You certainly know him better than most people on here, so I can appreciate your position and believe you when you say it. If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures.

CiPHPerCoder 10y ago
> If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mindless conformist whitehat who never exercises full disclosure when a vendor isn't taking security seriously (but oh man will they ever pay lip-service to the idea of taking security seriously)? That's what a lot of the comments in this thread would have him do, anyway. I think the best benefit he could get from reading the comments here is the realization that so much of the tech industry knee-jerk-defends software vendors without realizing the importance of diverse vulnerability disclosure practices. Then when someone gets particularly nasty with him, he can shrug it off as just a particularly-vocal entitled developer who has probably never found a security vulnerability before, and proceed with following the established P0 policies. But he probably already knows/realizes this. But ultimately, I think the comments here would be a waste of time that could better be spent on things that matter far more than the egos of most HN commenters. Myself especially.
- eganist 10y ago
  If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.
  - tptacek 10y ago
    I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.
    - eganist 10y ago
      Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
      - tptacek 10y ago
        I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
        eganist 10y ago
        That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
        10y ago
tptacek 10y ago
I know him barely at all. I met him once, at CanSecWest, in 2004. I remember it clearly, though, because he is famous. You basically have to not be in the software security industry to not know who he is. This isn't some elaborate scheme to hype up Chrome.
- eganist 10y ago
  Heh, I know of him, but I don't think a person's public persona dictates how that person conducts him/herself when it comes to a paycheck. Given that your endorsement is based on his public persona, I'm obligated to revert back to my original assumption that this very much is to hype up Chrome. Oh well ¯\_(ツ)_/¯

by eganist 10y ago

CiPHPerCoder 10y ago

> If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mindless conformist whitehat who never exercises full disclosure when a vendor isn't taking security seriously (but oh man will they ever pay lip-service to the idea of taking security seriously)? That's what a lot of the comments in this thread would have him do, anyway. I think the best benefit he could get from reading the comments here is the realization that so much of the tech industry knee-jerk-defends software vendors without realizing the importance of diverse vulnerability disclosure practices. Then when someone gets particularly nasty with him, he can shrug it off as just a particularly-vocal entitled developer who has probably never found a security vulnerability before, and proceed with following the established P0 policies. But he probably already knows/realizes this. But ultimately, I think the comments here would be a waste of time that could better be spent on things that matter far more than the egos of most HN commenters. Myself especially.

eganist 10y ago
If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.
- tptacek 10y ago
  I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.
  - eganist 10y ago
    Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
    - tptacek 10y ago
      I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
      - eganist 10y ago
        That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
        10y ago

tptacek 10y ago

I know him barely at all. I met him once, at CanSecWest, in 2004. I remember it clearly, though, because he is famous. You basically have to not be in the software security industry to not know who he is. This isn't some elaborate scheme to hype up Chrome.

eganist 10y ago
Heh, I know of him, but I don't think a person's public persona dictates how that person conducts him/herself when it comes to a paycheck. Given that your endorsement is based on his public persona, I'm obligated to revert back to my original assumption that this very much is to hype up Chrome. Oh well ¯\_(ツ)_/¯