3 ms·

If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Th

by eganist 10y ago

If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.

tptacek 10y ago
I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.
- eganist 10y ago
  Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
  - tptacek 10y ago
    I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
    - eganist 10y ago
      That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
      - tptacek 10y ago
        Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.
        eganist 10y ago
        > Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.

by eganist 10y ago

tptacek 10y ago

I can't even follow your argument anymore. Clearly, Mehta isn't a hype-man for Chrome. So what, exactly, is it that you want Google's security people to do? Their disclosure policies are probably the healthiest in the entire industry. If you're going to criticize them, please be as specific as you can.

eganist 10y ago
Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.
- tptacek 10y ago
  I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
  - eganist 10y ago
    That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
    - tptacek 10y ago
      Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.
      - eganist 10y ago
        > Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.