4 ms·

The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for ot

The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for other browsers, so why would they research fixes within those browsers? That assumption is just plain idiotic. They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome.

eganist 10y ago
> They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.
- tptacek 10y ago
  Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
  - eganist 10y ago
    > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? This question is strange. On the one hand, the disclosure scares users into switching to Chrome even though Microsoft asserts Edge offers protection. On the other hand, the disclosure actually does not disclose the details of a vulnerability that people are exploiting already. Would you rather have had the disclosure include the exact vulnerability? I've addressed your other questions surrounding the benefits and drawbacks in other threads. No point in re-hashing them.
    - tptacek 10y ago
      No, you can't move the goalposts like this. You just said Google should have waited to disclose until a complete fix was published. In asserting that, you must also assert you'd rather have Google disclose nothing than something.
      - eganist 10y ago
        I would rather Google disclose nothing to the public until there's a fix, or at least until a far-further-along date than 7 days from the initial disclosure to Microsoft. Now that that's settled: I didn't move the goalposts at all. I called into question the inconsistency in your implied assertion that people know the details thanks to this disclosure: > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? People do not know the details. The disclosure gave enough to inform those not privy on where to look. It did not inform the world as to the details of the issue. I'd rather Google have disclosed nothing because as I've stated in the vast majority of my other comments. My position hasn't changed: no one is benefited by a public disclosure here other than • Google (getting people to use Chrome as a defensive measure even though arguably Edge has this one covered), and • any unprivy malware authors who now know where to look. Microsoft isn't going to act any more quickly here. Security vendors are already rolling out mitigations. Google's only advice was "use our browser" even though there are multiple solutions, both in terms of software (Edge) and advising on user actions for the general untargeted population. They included nothing other than: > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. You asserted that they disclosed the details, which Google did not. So now that my position is set clearly in stone without you able to turn it around with an argument about moving goalposts, let's get back to my current question: Since you asserted that Google disclosed the details even though they did not, would you rather have had the disclosure include the exact vulnerability? Edited for formatting.
        tptacek 10y ago
        Lots more words, but we're back to the exact same place we were before: there's active exploitation of the bug, and you think Google should hide that fact to give Microsoft breathing room. That is an... unorthodox position to take.

eganist 10y ago

> They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.

tptacek 10y ago
Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
- eganist 10y ago
  > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? This question is strange. On the one hand, the disclosure scares users into switching to Chrome even though Microsoft asserts Edge offers protection. On the other hand, the disclosure actually does not disclose the details of a vulnerability that people are exploiting already. Would you rather have had the disclosure include the exact vulnerability? I've addressed your other questions surrounding the benefits and drawbacks in other threads. No point in re-hashing them.
  - tptacek 10y ago
    No, you can't move the goalposts like this. You just said Google should have waited to disclose until a complete fix was published. In asserting that, you must also assert you'd rather have Google disclose nothing than something.
    - eganist 10y ago
      I would rather Google disclose nothing to the public until there's a fix, or at least until a far-further-along date than 7 days from the initial disclosure to Microsoft. Now that that's settled: I didn't move the goalposts at all. I called into question the inconsistency in your implied assertion that people know the details thanks to this disclosure: > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? People do not know the details. The disclosure gave enough to inform those not privy on where to look. It did not inform the world as to the details of the issue. I'd rather Google have disclosed nothing because as I've stated in the vast majority of my other comments. My position hasn't changed: no one is benefited by a public disclosure here other than • Google (getting people to use Chrome as a defensive measure even though arguably Edge has this one covered), and • any unprivy malware authors who now know where to look. Microsoft isn't going to act any more quickly here. Security vendors are already rolling out mitigations. Google's only advice was "use our browser" even though there are multiple solutions, both in terms of software (Edge) and advising on user actions for the general untargeted population. They included nothing other than: > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. You asserted that they disclosed the details, which Google did not. So now that my position is set clearly in stone without you able to turn it around with an argument about moving goalposts, let's get back to my current question: Since you asserted that Google disclosed the details even though they did not, would you rather have had the disclosure include the exact vulnerability? Edited for formatting.
      - tptacek 10y ago
        Lots more words, but we're back to the exact same place we were before: there's active exploitation of the bug, and you think Google should hide that fact to give Microsoft breathing room. That is an... unorthodox position to take.