4 ms·

Vendors, even ones as large as Microsoft, do not have infinite resources available to evaluate vulnerabilities. There are only so many of the issues you can wo

Vendors, even ones as large as Microsoft, do not have infinite resources available to evaluate vulnerabilities. There are only so many of the issues you can work on at once. They have to evaluate each issue and prioritize the fix. In this case, they merely did not recognize the potential scope of the problem at hand.

DanielBMarkham 9y ago
That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause. Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced. What we need is a public and open way to do this that doesn't involved walled gardens.
- adrianN 9y ago
  I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.
  - DanielBMarkham 9y ago
    Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
    - stupidhn 9y ago
      Not sure why you're down voted. I had the same thought as parent, but this seems like the answer. A standard splash screen on load that pops up for 10 seconds and says "this program has known active vulnerabilities that are unpatched". If people choose to ignore it, that's on them. Cheap and easy, no?
      - adrianN 9y ago
        That still requires that a third party is allowed to flash things on my screen without my explicit consent.
        DanielBMarkham 9y ago
        Does it? We already have a solution to this, which I hate: walled gardens. I'm exploring options that preserve the peace while not letting companies effectively own their users. Maybe there is no answer that makes everybody happy. That's why it's worth asking questions. Just so I understand this, you're saying that if you have a piece of hardware that's say, taking down the local ISP because you're running compromised software on it, you don't want to even be notified before your box is compromised or that there might be a problem. Well, dang. Something's going to happen. That much is sure. What's the first notification you'd like that you're destroying the internet experience for others and perhaps ruining a local business? SWAT team at the door? I hear your complaint. I'm just not able to figure out how it makes sense.
        adrianN 9y ago
        I don't want other people to be able to change things on my computer. If my setup is causing problems on their end, they have my contact information and can tell me over traditional routes. An ISP can cut off my internet connection if they detect suspicious traffic.
- Terr_ 9y ago
  There's also an aspect of "capitalist tough-love". Sometimes companies do have resources for fixes and for general security-quality, but they don't budget or prioritize because there's no strong economic incentive.
- deleted 9y ago
  [deleted]
lawnchair_larry 9y ago
Nah, that's more false than it is true. I've seen Microsoft sit on cases simply because they can. I'm sure that they were not resource-bound in this case, they simply didn't make it a top priority. Their self-imposed timeline is 180 days by default. Unless it comes from Google of course, because they know Google take the 90 day deadline seriously (or 7 days for active attacks such as this). That alone speaks volumes, and pretty much validates the necessity of Google's forced disclosure policy.
- user5994461 9y ago
  Not everything is a trivial webservice with zero users, that can be patched overnight with no impact.
  - lawnchair_larry 9y ago
    I'm not sure how that's relevant.
    - user5994461 9y ago
      That's relevant to the time it takes to fix a vulnerability and deploy the patch.

DanielBMarkham 9y ago

That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause. Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced. What we need is a public and open way to do this that doesn't involved walled gardens.

adrianN 9y ago
I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.
- DanielBMarkham 9y ago
  Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
  - stupidhn 9y ago
    Not sure why you're down voted. I had the same thought as parent, but this seems like the answer. A standard splash screen on load that pops up for 10 seconds and says "this program has known active vulnerabilities that are unpatched". If people choose to ignore it, that's on them. Cheap and easy, no?
    - adrianN 9y ago
      That still requires that a third party is allowed to flash things on my screen without my explicit consent.
      - DanielBMarkham 9y ago
        Does it? We already have a solution to this, which I hate: walled gardens. I'm exploring options that preserve the peace while not letting companies effectively own their users. Maybe there is no answer that makes everybody happy. That's why it's worth asking questions. Just so I understand this, you're saying that if you have a piece of hardware that's say, taking down the local ISP because you're running compromised software on it, you don't want to even be notified before your box is compromised or that there might be a problem. Well, dang. Something's going to happen. That much is sure. What's the first notification you'd like that you're destroying the internet experience for others and perhaps ruining a local business? SWAT team at the door? I hear your complaint. I'm just not able to figure out how it makes sense.
        adrianN 9y ago
        I don't want other people to be able to change things on my computer. If my setup is causing problems on their end, they have my contact information and can tell me over traditional routes. An ISP can cut off my internet connection if they detect suspicious traffic.
Terr_ 9y ago
There's also an aspect of "capitalist tough-love". Sometimes companies do have resources for fixes and for general security-quality, but they don't budget or prioritize because there's no strong economic incentive.
deleted 9y ago
[deleted]

lawnchair_larry 9y ago

Nah, that's more false than it is true. I've seen Microsoft sit on cases simply because they can. I'm sure that they were not resource-bound in this case, they simply didn't make it a top priority. Their self-imposed timeline is 180 days by default. Unless it comes from Google of course, because they know Google take the 90 day deadline seriously (or 7 days for active attacks such as this). That alone speaks volumes, and pretty much validates the necessity of Google's forced disclosure policy.

user5994461 9y ago
Not everything is a trivial webservice with zero users, that can be patched overnight with no impact.
- lawnchair_larry 9y ago
  I'm not sure how that's relevant.
  - user5994461 9y ago
    That's relevant to the time it takes to fix a vulnerability and deploy the patch.