5 ms·

Looks like they thought this would get fixed: > I will not make any further comments on exploitability, at least not until the bug is fixed. The report has too

by rattray 10y ago

Looks like they thought this would get fixed: > I will not make any further comments on exploitability, at least not until the bug is fixed. The report has too much info on that as it is (I really didn't expect this one to miss the deadline). Worth mentioning that "Goes Public" implies there was a human who pulled the trigger; it was a bot: > This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public. ... > Deadline exceeded -- automatically derestricting

muthuraj57 10y ago
> there was a human who pulled the trigger; it was a bot: is it a human or a bot?
- roflc0ptic 10y ago
  GP is saying "although the headline makes it sound like a human did this, it was actually a bot, as the following text from the tracker shows:"
  - ProAm 10y ago
    A human programmed the bot.
    - samstave 10y ago
      But the bot pulled the trigger :-)
      - PascLeRasc 10y ago
        You might like The Office (US) S8E6.
- mnem 10y ago
  A bot.
- cortesoft 10y ago
  Your partial quote leaves out the word 'implies', which makes it exactly clear that it is a bot and not a human.
obstinate 10y ago
I think the person making that comment is confused about how this works. The bug was filed in November. The deadline passed before the comment was made.
- rattray 10y ago
  The "Deadline exceeded -- automatically derestricting" comment was posted on Feb 23, 90 days[0] after Nov 25. The account that posted it, hawkes@google.com, is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions. There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release". [0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/ https://bugs.chromium.org/u/1279493906/
- btilly 10y ago
  Which person making which comment? The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved. Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.
  - obstinate 10y ago
    Oops. I misread "(I really didn't expect this one to miss the deadline)" as "I really don't expect . . ." in #5.
DINKDINK 10y ago
>"Goes Public" implies there was a human who pulled the trigger; it was a bot: Meaningless distinction, a human designed the bot that pulled the trigger. Building a robot that then murders someone doesn't absolve the designer from the ramifications of what they built.
- SSLy 10y ago
  Until we get seeded AGI's, that is.
- dsacco 10y ago
  It's not meaningless. It would be more appropriate to compare it to a human-designed insurance algorithm that will refuse to offer a discount for extenuating circumstances. That's not so much an analogy as it is a reimplemented example of the same philosophy in practice. The meaningful distinction is that a human can be persuaded to extend the deadline, at least in theory. A bot cannot be persuaded to do anything, and if a deadline passes an action is triggered like a dead man's switch. In one scenario, a human needs to maintain the decision to uphold that deadline without bias every single time it comes into question. In the other, they only have to do it once: when the bot is initially designed. They're different things entirely. Arguing that they're not is like arguing that it's easy to maintain a diet or exercise regimen because you just have to uphold a New Year's resolution for a week. This has important ramifications for a security disclosure deadline, because it (theoretically) reduces bias. There are other elements of a disclosure that can still elicit bias, but at least the deadline time itself will not be one of them.
  - deleted 10y ago
    [deleted]
- rucker 10y ago
  I think you're being pedantic. It's pretty clear what the headline implies and what the parent commenter is saying. From headline reading "X goes public with...", most people would infer a scenario where something out of the ordinary is taking place. Pointing out that this disclosure was made by a bot is a meaningful distinction.

by rattray 10y ago

muthuraj57 10y ago

> there was a human who pulled the trigger; it was a bot: is it a human or a bot?

roflc0ptic 10y ago
GP is saying "although the headline makes it sound like a human did this, it was actually a bot, as the following text from the tracker shows:"
- ProAm 10y ago
  A human programmed the bot.
  - samstave 10y ago
    But the bot pulled the trigger :-)
    - PascLeRasc 10y ago
      You might like The Office (US) S8E6.
mnem 10y ago
A bot.
cortesoft 10y ago
Your partial quote leaves out the word 'implies', which makes it exactly clear that it is a bot and not a human.

obstinate 10y ago

I think the person making that comment is confused about how this works. The bug was filed in November. The deadline passed before the comment was made.

rattray 10y ago
The "Deadline exceeded -- automatically derestricting" comment was posted on Feb 23, 90 days[0] after Nov 25. The account that posted it, hawkes@google.com, is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions. There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release". [0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/ https://bugs.chromium.org/u/1279493906/
btilly 10y ago
Which person making which comment? The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved. Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.
- obstinate 10y ago
  Oops. I misread "(I really didn't expect this one to miss the deadline)" as "I really don't expect . . ." in #5.

DINKDINK 10y ago

>"Goes Public" implies there was a human who pulled the trigger; it was a bot: Meaningless distinction, a human designed the bot that pulled the trigger. Building a robot that then murders someone doesn't absolve the designer from the ramifications of what they built.

SSLy 10y ago
Until we get seeded AGI's, that is.
dsacco 10y ago
It's not meaningless. It would be more appropriate to compare it to a human-designed insurance algorithm that will refuse to offer a discount for extenuating circumstances. That's not so much an analogy as it is a reimplemented example of the same philosophy in practice. The meaningful distinction is that a human can be persuaded to extend the deadline, at least in theory. A bot cannot be persuaded to do anything, and if a deadline passes an action is triggered like a dead man's switch. In one scenario, a human needs to maintain the decision to uphold that deadline without bias every single time it comes into question. In the other, they only have to do it once: when the bot is initially designed. They're different things entirely. Arguing that they're not is like arguing that it's easy to maintain a diet or exercise regimen because you just have to uphold a New Year's resolution for a week. This has important ramifications for a security disclosure deadline, because it (theoretically) reduces bias. There are other elements of a disclosure that can still elicit bias, but at least the deadline time itself will not be one of them.
- deleted 10y ago
  [deleted]
rucker 10y ago
I think you're being pedantic. It's pretty clear what the headline implies and what the parent commenter is saying. From headline reading "X goes public with...", most people would infer a scenario where something out of the ordinary is taking place. Pointing out that this disclosure was made by a bot is a meaningful distinction.