5 ms·

I hadn't noticed this before, but aphyr has an elaborate and articulate ethics policy: http://jepsen.io/ethics http://jepsen.io/ethics I like it.

• tptacek 10y ago
  It's really good. I feel like a lot of security consulting shops could benefit from it as well.
• lmm 10y ago
  So a client can get the analysis done and leave it unpublished if they don't like the results? Maybe that's standard practice but it doesn't seem great for users.
  • cjbprime 10y ago
    Where does the policy say that? I see: > "Once I've prepared a written analysis, the client may defer publication by up to three months. This gives the client a chance to understand the faults I've identified, attempt to fix bugs, update documentation, and deploy fixes to users." So, a client can get the analysis done and attempt to defer publication for three months, after which time it'll be published. No?
  • deleted 10y ago
    [deleted]
  • dataminded 10y ago
    Isn't their policy just responsible disclosure? If you find a security bug, shouldn't the company have a chance to fix it before it goes public?
  • aphyr 10y ago
    I agree. In my ideal world I publish everything immediately. There's no "standard practice" that I know of--very few people are doing this kind of work. Behind every one of these analyses is weeks of contract negotiation where I try to convince assorted lawyers & CFOs to go along with my weird, idealistic ethical policies. And conversely, those lawyers and CFOs do their best to balance the desire for correctness with their duty to protect the company. This policy outlines how we compromise. Originally I did offer a client veto, because clients weren't willing to sign without some assurance of control over the outcome. My current standard contract for analyses actually drops that client veto: I have final say on the analysis content and publication. There's still a grace period to allow the vendor to fix bugs & get things in order. I'm adopting this as the standard going forward, but it's been a long road to get there. That said, I do perform private consulting--usually for in-house systems, sometimes for clients that can't afford a full analysis, and sometimes as a precursor to more involved work. That means that yes, vendors may be aware of bugs and I won't have told you about them--but I promise that my public work remains honest and forthcoming.
    • remar 10y ago
      Hey, just wanted to say I really appreciate all the in depth posts you put out on your site in hopes of educating others and helping them navigate the waters of distributed systems. Curious, is there any single book you would say you've found to be the equivalent of say CLRS but for the fundamentals of distributed computing paradigms? My current plan for deep diving into distributed systems theory has just been to go through resources like "Distributed systems for fun and profit", and aggregated lists/overviews like https://henryr.github.io/distributed-systems-readings/ https://henryr.github.io/distributed-systems-readings/ and your distsys-class notes and then just DFS into certain topics from there - compared to the approach I've been taking with deep diving into OS and database theory which is just to go through text books like Operating System Concepts and Database System Concepts while applying the theory in side projects.
  • segmondy 10y ago
    the client is paying for it, as a user, if you really want to bet your company on XYZ tech, you can pay to have Aphyr to perform a jepsen test on it.