6 ms·

Full disclosure feels very much like pointing at my house and saying "This house here has a lock which you can get past using a Bic pen if you insert it with th

by arjie 10y ago

Full disclosure feels very much like pointing at my house and saying "This house here has a lock which you can get past using a Bic pen if you insert it with the rounded end and turn it clockwise. You could then steal all the things inside." I get what you mean about "responsible disclosure" leaving users in the dark here but I'd feel much better if you'd just tell me there's a problem with my door before you put it in the neighbourhood news bulletin. To make it worse, the vendor has the means to inform every user whereas you have the means to inform some tiny subset. I see this as a discussion of trade-offs whereas you seem to see this as an obvious truth on your side of the argument. That's the only part that concerns me.

kbenson 10y ago
> Full disclosure feels very much like pointing at my house and saying "This house here has a lock which you can get past using a Bic pen if you insert it with the rounded end and turn it clockwise. You could then steal all the things inside." No, it's like going on TV and telling everyone that a certain brand of lock, which you happen to use, is easily circumvented with a Bic pen. Feel free to get a new lock, or do something else to increase your security if you feel it's warranted, as the lock isn't good protection, and it wasn't prior to the announcement either. You might find this[1] relevant. This is how bad locks can be. Would you rather use this lock in ignorance, or immediately replace it? Particularly of note is the 20 seconds or so starting at 4:10, where he makes it very obvious just how bad this lock is. Also note how he says "Geez, keep sending me stuff like this and you'll get me sued by Master Lock again." 1: https://www.youtube.com/watch?v=4UFrFvRUsSg https://www.youtube.com/watch?v=4UFrFvRUsSg
- tptacek 10y ago
  Exactly. My front door has a lock we open with keys, which is all we rely on normally. It also has deadbolts, which we use when we're out of town. Tell me my keyed lock --- tell everyone my keyed lock is unsafe! We'll just set the deadbolts until we can replace it. What I don't want you do is secretly working with the vendor of my lock to fit some kind of solution to their problem into their product shipping schedule.
  - arjie 10y ago
    You're not telling everyone, though, are you? As a matter of fact, you're probably not even telling a small number of people who have the lock. You won't be setting your deadbolt because, guess what, the guy who found the problem told your local Linux Users' Group, not you. And you don't attend your local Linux Users' Group. If you were telling everyone that would be another thing.
    - tptacek 10y ago
      We're talking about someone posting on Twitter about bugs, not someone giving secret presentations at LUGs. I don't like telling vulnerability researchers what to do. Of all the ethical issues involved in vulnerability disclosure, the most important to me is the fact that these researchers are doing free work for the vendors, who bear all the obligations of ensuring that they're not shipping vulnerabilities in the first place. I think these debates about "disclosure ethics" mostly serve the vendors, who want to deflect from discussions about how they manage to ship vulnerabilities that third parties can find. But if I had to have a problem with any disclosure process, it's the "secret cabal" model, which has always been an problem for me, all the way back into the 1990s with things like the CORE list.
      - arjie 10y ago
        I'm not going to argue against your position on security experts' freedom to act because I do not think that any law (or societal taboo) should be made abridging their right to disclose in any way the results of their research. If there is any withholding, I want them to do it of their own accord because they are convinced of the merits of withholding, not because of anything else. So let's set that argument completely aside because there's no disagreement on that front. Twitter is the equivalent of your local LUG in the scale of things. My mum is not reading Twitter for security news, or even at all. What my mum is doing, is having her stuff update. And my dad's no different. It might as well be some presentation at DEFCON. I want my vendor to disable functionality that's vulnerable. And I want them to be given a chance to do that. If you feel you are adequately warning users by fully disclosing via a Twitter post then so be it. I think I've made all the arguments I have to make on the topic. If they are insufficient, then that is where I must leave it. To anyone reading afterwards who may not be sure about my position, I feel positively about how this vulnerability was handled.
- deleted 10y ago
  [deleted]
- arjie 10y ago
  Well, we're not comparing "not knowing" to "knowing". We're comparing "vendor tells all customers" vs. "you tell a small fraction of customers". I would rather have the former. Also, I didn't pick the Bic pen thing randomly. Certain Kryptonite locks were once famously demonstrated to be Bic pen unlockable.
- godelski 10y ago
  In the case of a lock you have to go out and buy a new one. A difference in software is that your lock can improve its security without buying a new one. If a vulnerability in your lock is found and the lock manufacturer buys you a new lock within a week, do you stop trusting that manufacturer?
  - kbenson 10y ago
    So, because some companies are good at fixing things in a timely manner, we should make the public wait for all vendors? What about problems that are more architectural or design specific that aren't easily fixed, or can't be fixed by the nature of the discovery (math proofs)? What about vulnerabilities that seem fairly benign, but when used in conjunction with other benign vulnerabilities result in something greater (e.g. the ability to influence timing attacks)? What is a serious problem is subjective. The right amount of time to wait is subjective. In both cases, there will be people that are unhappy with how they were or weren't informed. Instead of some select group of people deciding how important the fix is and when it will be fixed, announcing immediately empowers the public.
    - exergy 10y ago
      Really great discussion. To my complete layperson mind, perhaps a good middle ground is that if you are the person who discovers a big security bug, you first go to the company in private, but with the caveat that you insist on being informed, perhaps daily(?), of progress. If you feel that the vulnerability is big, and the company is taking it seriously enough, you give them an honest chance, otherwise if they slack or hum and haw, you go to the public. The nuance here is that we trust the person who discovered the hole to make subjective judgements about the severity of it and the company's response, and we force the company to be more transparent than usual to the person who discovered it about how they are working/nature of the code fix. But maybe that could be a good thing?
      - godelski 10y ago
        >If you feel that the vulnerability is big, and the company is taking it seriously enough, you give them an honest chance, otherwise if they slack or hum and haw, you go to the public. This. I fully agree with this. Obscurity is a good form of security in a temporary sense. But vulnerabilities should ALWAYS be disclosed to the public, for a number of reasons. The question is when. Disclosing does a couple things: 1) We see a company fixes them in a timely manner, which gives us trust in services that we use (and the opposite if they fail to) 2) other companies don't make the same mistakes because now the vulnerability is googleable and quickly becoming public knowledge.
- pbhjpbhj 10y ago
  The point is the "lock" can't be immediately replaced, by the user, in most software exploit scenarios. That's why you delay, so the company can ship a new "lock" so that when malevolent forces who didn't know of the exploit learn of it the new "lock" is ready to do duty. It depends on the specifics of what's being exploited but in general I think a short delay between informing those who can fix it and those who will exploit it is generally more moral.
  - cryptarch 10y ago
    The lock cannot be replaced, but it can be put behind another lock or temporarily taken out of commission. In the case of the Lastpass exploit it would've been to not use Lastpass for a few days. That's one benefit of direct disclosure to the user.
    - AnkhMorporkian 10y ago
      That really isn't an option for most users. People who use a password manager are pretty much forced to use that password manager, at least if they're using it properly. Most users won't know how to export it to a CSV and then use that without a browser extension and/or import that to another password manager.
      - pluma 10y ago
        Also "not using it" depending on the kind of exploit may mean completely shutting down the account until the vulnerability is fixed.
        Thrillington 10y ago
        Isn't that the right thing to do for truly sensitive passwords? I'd much rather transcribe my financial account passwords to paper, or not log in for a couple days than have multiple months where a vulnerability might be exploitable
      - scott00 10y ago
godelski 10y ago
Which makes for a totally fine situation of "Hey neighbor, nevermind how I know this, but I can open your door with a Bic pen and steal all your stuff if I wanted to" "Well no one is going to try that. So I'm safe" Post instructions But if the person asks for help to prevent it, and especially if you're being paid (like Travis) or a good neighbor, help them before you post instructions. So the instructions you post aren't useful to break into your neighbor's house.
- kbenson 10y ago
  And if you know 5, or 10, or 15 people with this lock, what then? Do you spend time helping them all? What about all the people that aren't your friends? You are helping your friends at their expense because you assume you are the only person to know about this. Is it more ethical to help your friends over the public at large?
  - godelski 10y ago
    > And if you know 5, or 10, or 15 people with this lock, what then? You tell them. >>Do you spend time helping them all? No >>Is it more ethical to help your friends over the public at large? It is more ethical to help the major players. We're talking about a company that holds a significant portion of users data. If we found Master Lock had a vulnerability, we'd expect them to fix it (we wouldn't expect them to replace every users' lock for a number of reasons that are different from a software vulnerability, but it wouldn't be unreasonable for them to notify users and/or provide a coupon). It also wouldn't be unreasonable to wait for Master Lock (who controls a significant portion of the market) to fix it before making it public. Making it public means everyone can fix it. But let the majority have an attempt to fix it before letting the public, and malicious factions, know.

by arjie 10y ago

kbenson 10y ago

> Full disclosure feels very much like pointing at my house and saying "This house here has a lock which you can get past using a Bic pen if you insert it with the rounded end and turn it clockwise. You could then steal all the things inside." No, it's like going on TV and telling everyone that a certain brand of lock, which you happen to use, is easily circumvented with a Bic pen. Feel free to get a new lock, or do something else to increase your security if you feel it's warranted, as the lock isn't good protection, and it wasn't prior to the announcement either. You might find this[1] relevant. This is how bad locks can be. Would you rather use this lock in ignorance, or immediately replace it? Particularly of note is the 20 seconds or so starting at 4:10, where he makes it very obvious just how bad this lock is. Also note how he says "Geez, keep sending me stuff like this and you'll get me sued by Master Lock again." 1: https://www.youtube.com/watch?v=4UFrFvRUsSg https://www.youtube.com/watch?v=4UFrFvRUsSg

tptacek 10y ago
Exactly. My front door has a lock we open with keys, which is all we rely on normally. It also has deadbolts, which we use when we're out of town. Tell me my keyed lock --- tell everyone my keyed lock is unsafe! We'll just set the deadbolts until we can replace it. What I don't want you do is secretly working with the vendor of my lock to fit some kind of solution to their problem into their product shipping schedule.
- arjie 10y ago
  You're not telling everyone, though, are you? As a matter of fact, you're probably not even telling a small number of people who have the lock. You won't be setting your deadbolt because, guess what, the guy who found the problem told your local Linux Users' Group, not you. And you don't attend your local Linux Users' Group. If you were telling everyone that would be another thing.
  - tptacek 10y ago
    We're talking about someone posting on Twitter about bugs, not someone giving secret presentations at LUGs. I don't like telling vulnerability researchers what to do. Of all the ethical issues involved in vulnerability disclosure, the most important to me is the fact that these researchers are doing free work for the vendors, who bear all the obligations of ensuring that they're not shipping vulnerabilities in the first place. I think these debates about "disclosure ethics" mostly serve the vendors, who want to deflect from discussions about how they manage to ship vulnerabilities that third parties can find. But if I had to have a problem with any disclosure process, it's the "secret cabal" model, which has always been an problem for me, all the way back into the 1990s with things like the CORE list.
    - arjie 10y ago
      I'm not going to argue against your position on security experts' freedom to act because I do not think that any law (or societal taboo) should be made abridging their right to disclose in any way the results of their research. If there is any withholding, I want them to do it of their own accord because they are convinced of the merits of withholding, not because of anything else. So let's set that argument completely aside because there's no disagreement on that front. Twitter is the equivalent of your local LUG in the scale of things. My mum is not reading Twitter for security news, or even at all. What my mum is doing, is having her stuff update. And my dad's no different. It might as well be some presentation at DEFCON. I want my vendor to disable functionality that's vulnerable. And I want them to be given a chance to do that. If you feel you are adequately warning users by fully disclosing via a Twitter post then so be it. I think I've made all the arguments I have to make on the topic. If they are insufficient, then that is where I must leave it. To anyone reading afterwards who may not be sure about my position, I feel positively about how this vulnerability was handled.
deleted 10y ago
[deleted]
arjie 10y ago
Well, we're not comparing "not knowing" to "knowing". We're comparing "vendor tells all customers" vs. "you tell a small fraction of customers". I would rather have the former. Also, I didn't pick the Bic pen thing randomly. Certain Kryptonite locks were once famously demonstrated to be Bic pen unlockable.
godelski 10y ago
In the case of a lock you have to go out and buy a new one. A difference in software is that your lock can improve its security without buying a new one. If a vulnerability in your lock is found and the lock manufacturer buys you a new lock within a week, do you stop trusting that manufacturer?
- kbenson 10y ago
  So, because some companies are good at fixing things in a timely manner, we should make the public wait for all vendors? What about problems that are more architectural or design specific that aren't easily fixed, or can't be fixed by the nature of the discovery (math proofs)? What about vulnerabilities that seem fairly benign, but when used in conjunction with other benign vulnerabilities result in something greater (e.g. the ability to influence timing attacks)? What is a serious problem is subjective. The right amount of time to wait is subjective. In both cases, there will be people that are unhappy with how they were or weren't informed. Instead of some select group of people deciding how important the fix is and when it will be fixed, announcing immediately empowers the public.
  - exergy 10y ago
    Really great discussion. To my complete layperson mind, perhaps a good middle ground is that if you are the person who discovers a big security bug, you first go to the company in private, but with the caveat that you insist on being informed, perhaps daily(?), of progress. If you feel that the vulnerability is big, and the company is taking it seriously enough, you give them an honest chance, otherwise if they slack or hum and haw, you go to the public. The nuance here is that we trust the person who discovered the hole to make subjective judgements about the severity of it and the company's response, and we force the company to be more transparent than usual to the person who discovered it about how they are working/nature of the code fix. But maybe that could be a good thing?
    - godelski 10y ago
      >If you feel that the vulnerability is big, and the company is taking it seriously enough, you give them an honest chance, otherwise if they slack or hum and haw, you go to the public. This. I fully agree with this. Obscurity is a good form of security in a temporary sense. But vulnerabilities should ALWAYS be disclosed to the public, for a number of reasons. The question is when. Disclosing does a couple things: 1) We see a company fixes them in a timely manner, which gives us trust in services that we use (and the opposite if they fail to) 2) other companies don't make the same mistakes because now the vulnerability is googleable and quickly becoming public knowledge.
pbhjpbhj 10y ago
The point is the "lock" can't be immediately replaced, by the user, in most software exploit scenarios. That's why you delay, so the company can ship a new "lock" so that when malevolent forces who didn't know of the exploit learn of it the new "lock" is ready to do duty. It depends on the specifics of what's being exploited but in general I think a short delay between informing those who can fix it and those who will exploit it is generally more moral.
- cryptarch 10y ago
  The lock cannot be replaced, but it can be put behind another lock or temporarily taken out of commission. In the case of the Lastpass exploit it would've been to not use Lastpass for a few days. That's one benefit of direct disclosure to the user.
  - AnkhMorporkian 10y ago
    That really isn't an option for most users. People who use a password manager are pretty much forced to use that password manager, at least if they're using it properly. Most users won't know how to export it to a CSV and then use that without a browser extension and/or import that to another password manager.
    - pluma 10y ago
      Also "not using it" depending on the kind of exploit may mean completely shutting down the account until the vulnerability is fixed.
      - Thrillington 10y ago
        Isn't that the right thing to do for truly sensitive passwords? I'd much rather transcribe my financial account passwords to paper, or not log in for a couple days than have multiple months where a vulnerability might be exploitable
    - scott00 10y ago

godelski 10y ago

Which makes for a totally fine situation of "Hey neighbor, nevermind how I know this, but I can open your door with a Bic pen and steal all your stuff if I wanted to" "Well no one is going to try that. So I'm safe" Post instructions But if the person asks for help to prevent it, and especially if you're being paid (like Travis) or a good neighbor, help them before you post instructions. So the instructions you post aren't useful to break into your neighbor's house.

kbenson 10y ago
And if you know 5, or 10, or 15 people with this lock, what then? Do you spend time helping them all? What about all the people that aren't your friends? You are helping your friends at their expense because you assume you are the only person to know about this. Is it more ethical to help your friends over the public at large?
- godelski 10y ago
  > And if you know 5, or 10, or 15 people with this lock, what then? You tell them. >>Do you spend time helping them all? No >>Is it more ethical to help your friends over the public at large? It is more ethical to help the major players. We're talking about a company that holds a significant portion of users data. If we found Master Lock had a vulnerability, we'd expect them to fix it (we wouldn't expect them to replace every users' lock for a number of reasons that are different from a software vulnerability, but it wouldn't be unreasonable for them to notify users and/or provide a coupon). It also wouldn't be unreasonable to wait for Master Lock (who controls a significant portion of the market) to fix it before making it public. Making it public means everyone can fix it. But let the majority have an attempt to fix it before letting the public, and malicious factions, know.