5 ms·

> If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mi

> If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mindless conformist whitehat who never exercises full disclosure when a vendor isn't taking security seriously (but oh man will they ever pay lip-service to the idea of taking security seriously)? That's what a lot of the comments in this thread would have him do, anyway. I think the best benefit he could get from reading the comments here is the realization that so much of the tech industry knee-jerk-defends software vendors without realizing the importance of diverse vulnerability disclosure practices. Then when someone gets particularly nasty with him, he can shrug it off as just a particularly-vocal entitled developer who has probably never found a security vulnerability before, and proceed with following the established P0 policies. But he probably already knows/realizes this. But ultimately, I think the comments here would be a waste of time that could better be spent on things that matter far more than the egos of most HN commenters. Myself especially.

eganist 10y ago
If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.
- tptacek 10y ago
  I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.
  - eganist 10y ago
    Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
    - tptacek 10y ago
      I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
      - eganist 10y ago
        That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
        tptacek 10y ago
        Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.

eganist 10y ago

If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.

tptacek 10y ago
I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.
- eganist 10y ago
  Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
  - tptacek 10y ago
    I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
    - eganist 10y ago
      That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
      - tptacek 10y ago
        Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.