3 ms·

How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? I am able to extract the details for mak

by acqq 10y ago

How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? I am able to extract the details for making the attack and I just can't imagine. The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. Unless you give some specific examples, I assume you don't know what you're talking about.

kbenson 10y ago
> How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? Adobe patched flash before it public. Chrome protects from the specific Windows problem. Using Chrome for the time between the announcement and a fix would mitigate the attack. This course of action would leave anyone who was not already donig it safer, and in this case is easy to do. > The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. As I said above, an easy mitigation exists above. Using Chrome for a few days if you weren't already if all you have to do to protect yourself from remote execution of this until it's patched. It's not any one person or organization's place to decide the course of action for everyone else because they have secret information. The responsible thing to do if people have the the ability to change how it affects them is to disclose this information. To do otherwise is to make everyone's decision for them. It's the same principle that leads to the freedom of press. The people have aright to know about information that affects them when their choices matter.
- acqq 10y ago
  > Using Chrome for the time between the announcement and a fix would mitigate the attack. This example you gave supports my claim, not yours: "they can use Chrome" is exactly something for what the public doesn't need to know exactly which API in which system DLL contains the bug when invoked under which circumstances, knowledge of which can be used to develop new attacks.
  - kbenson 10y ago
    Except that once it's made public, other browser vendors can put in their own mitigations as well. Firefox would probably have a patch of some sort within hours. You might respond that Google should just tell the other browser vendors then. But why just the other browser vendors? Why would Google get to choose who qualifies as worth notifying? I stand by my assertion. When the public is at risk, and they have the ability to take steps to reduce that risk, it is their right to know about that risk so they can take those steps if they desire. If there were a gang of thieves working through an area taking advantage of the local population because the majority of locks sold in the area had a major flaw, I would expect it to be reported. That may spur the thieves to change how they operate, and may in some ways make them much harder to catch, but it's irresponsible to not notify the people in danger so they have a chance to protect themselves and their property, and explain what the problem is. They need to explain how it works so people can feel assured any fixes put in place actually fix the problem,and the easiest way to tell if you are in danger is often to try the exploit of the flaw yourself, because sometimes it affects more than the discoverer and the company involved thought. You either believe the responsible thing to do is to report the details, or never report them. If you believe the responsible thing to do is to report the details, then it's just a matter of when. If it's being actively exploited, like it is here, and if you agree that a year is too long, and no time is too short, then it's a matter of choosing an amount of time that provides the vendor time to fix the exploit while reducing the number of people that might suffer in the meantime. You can either try to make decisions on a case by case basis, which will ultimately be arbitrary, or you can set a policy and follow it. Microsoft had a week to get a fix out. If it was important enough to them, they would have. They have the talent, time, money and existing resources to do so. It wouldn't necessarily have been easy, but not doing so is a failure on their part, not Googles. I won't fault Google for giving me the choice to protect myself when Microsoft won't.

by acqq 10y ago

kbenson 10y ago

> How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? Adobe patched flash before it public. Chrome protects from the specific Windows problem. Using Chrome for the time between the announcement and a fix would mitigate the attack. This course of action would leave anyone who was not already donig it safer, and in this case is easy to do. > The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. As I said above, an easy mitigation exists above. Using Chrome for a few days if you weren't already if all you have to do to protect yourself from remote execution of this until it's patched. It's not any one person or organization's place to decide the course of action for everyone else because they have secret information. The responsible thing to do if people have the the ability to change how it affects them is to disclose this information. To do otherwise is to make everyone's decision for them. It's the same principle that leads to the freedom of press. The people have aright to know about information that affects them when their choices matter.

acqq 10y ago
> Using Chrome for the time between the announcement and a fix would mitigate the attack. This example you gave supports my claim, not yours: "they can use Chrome" is exactly something for what the public doesn't need to know exactly which API in which system DLL contains the bug when invoked under which circumstances, knowledge of which can be used to develop new attacks.
- kbenson 10y ago
  Except that once it's made public, other browser vendors can put in their own mitigations as well. Firefox would probably have a patch of some sort within hours. You might respond that Google should just tell the other browser vendors then. But why just the other browser vendors? Why would Google get to choose who qualifies as worth notifying? I stand by my assertion. When the public is at risk, and they have the ability to take steps to reduce that risk, it is their right to know about that risk so they can take those steps if they desire. If there were a gang of thieves working through an area taking advantage of the local population because the majority of locks sold in the area had a major flaw, I would expect it to be reported. That may spur the thieves to change how they operate, and may in some ways make them much harder to catch, but it's irresponsible to not notify the people in danger so they have a chance to protect themselves and their property, and explain what the problem is. They need to explain how it works so people can feel assured any fixes put in place actually fix the problem,and the easiest way to tell if you are in danger is often to try the exploit of the flaw yourself, because sometimes it affects more than the discoverer and the company involved thought. You either believe the responsible thing to do is to report the details, or never report them. If you believe the responsible thing to do is to report the details, then it's just a matter of when. If it's being actively exploited, like it is here, and if you agree that a year is too long, and no time is too short, then it's a matter of choosing an amount of time that provides the vendor time to fix the exploit while reducing the number of people that might suffer in the meantime. You can either try to make decisions on a case by case basis, which will ultimately be arbitrary, or you can set a policy and follow it. Microsoft had a week to get a fix out. If it was important enough to them, they would have. They have the talent, time, money and existing resources to do so. It wouldn't necessarily have been easy, but not doing so is a failure on their part, not Googles. I won't fault Google for giving me the choice to protect myself when Microsoft won't.