5 ms·

security "researcher" does something questionable in order to generate publicity, news at 11

by sayrer 16y ago

deleted 16y ago
[deleted]
tptacek 16y ago
Tavis is the real deal, Robert.
- ghshephard 16y ago
  His actions indicate otherwise. Surely any halfways mature security researcher realizes the following two facts: #1 - In excess of 95% of all security patches/updates/workarounds implemented on a windows platform are those that come through the automatic update process #2 - Upon disclosure, the universe of script kiddies which never, ever, would have discovered this security exploit on their own have now been handed a gift which they will exploit with their rudimentary skills. I'm a strong proponent of responsible disclosure, and really believe that it has made our platforms much, much more secure, obviously in an absolute sense, but also, in a relative sense. But, responsible disclosure involves giving the vendor a reasonable amount of time - typically one or two patch cycles, prior to releasing the exploit. Anything other than that is juvenile and besmirches the community of responsible security researchers.
  - tptacek 16y ago
    You are unlikely to find anyone in the "community of responsible security researchers" to say anything negative about Tavis Ormandy. It is way over the top to imply that he's not "halfways mature". You will, on the other hand, find plenty of people with real reputations in the industry at stake (unlike yours, which is influenced not one whit by anything you say about disclosure) who will be happy to explain why "responsible disclosure" is damaging the industry. It's not even a hard argument to make. The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them. Meanwhile, because product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's, people get to wait 6-18 months for fixes to trivial problems. Personally, without wading into "responsible" vs. "full" disclosure, I will point out that vulnerability research has made your systems more secure; the manner in which the vulnerabilities were uncovered has very little to do with it. You are more secure now because vendors and customers pay to have software tested before and after shipping it. (My personal beliefs don't often enter the picture; I represent the interests of my clients, almost all of whom would rather fix things on their own schedule). This is an issue that reasonable and responsible people disagree about.
    - sayrer 16y ago
      That reply contains a rather petty ad hominem attack about the relevance of someone's security industry reputation. But I am interested in the argument about "responsible disclosure" damaging "the industry" is one I would like to hear. Since it's not hard to make, it should be easy to repeat. I'm not sure what "the industry" is here, though. Some other strange parts of the response: "The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them." Why accuse someone of pretending? I would not be surprised to find that you are right, but you should be able to point at data. Another problem is use of the passive voice: "product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's" Who gives them that latitude?
      - tptacek 16y ago
        Pointing out that people are willing to put their money where their mouths are, and that nobody in this particular message board has so far, is not ad hominem. If he's insulted to hear me point out that he's not a security researcher, I'm surprised. The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, Robert, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software.

security "researcher" does something questionable in order to generate publicity, news at 11

by sayrer 16y ago

security "researcher" does something questionable in order to generate publicity, news at 11

deleted 16y ago

[deleted]

tptacek 16y ago

Tavis is the real deal, Robert.

ghshephard 16y ago
His actions indicate otherwise. Surely any halfways mature security researcher realizes the following two facts: #1 - In excess of 95% of all security patches/updates/workarounds implemented on a windows platform are those that come through the automatic update process #2 - Upon disclosure, the universe of script kiddies which never, ever, would have discovered this security exploit on their own have now been handed a gift which they will exploit with their rudimentary skills. I'm a strong proponent of responsible disclosure, and really believe that it has made our platforms much, much more secure, obviously in an absolute sense, but also, in a relative sense. But, responsible disclosure involves giving the vendor a reasonable amount of time - typically one or two patch cycles, prior to releasing the exploit. Anything other than that is juvenile and besmirches the community of responsible security researchers.
- tptacek 16y ago
  You are unlikely to find anyone in the "community of responsible security researchers" to say anything negative about Tavis Ormandy. It is way over the top to imply that he's not "halfways mature". You will, on the other hand, find plenty of people with real reputations in the industry at stake (unlike yours, which is influenced not one whit by anything you say about disclosure) who will be happy to explain why "responsible disclosure" is damaging the industry. It's not even a hard argument to make. The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them. Meanwhile, because product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's, people get to wait 6-18 months for fixes to trivial problems. Personally, without wading into "responsible" vs. "full" disclosure, I will point out that vulnerability research has made your systems more secure; the manner in which the vulnerabilities were uncovered has very little to do with it. You are more secure now because vendors and customers pay to have software tested before and after shipping it. (My personal beliefs don't often enter the picture; I represent the interests of my clients, almost all of whom would rather fix things on their own schedule). This is an issue that reasonable and responsible people disagree about.
  - sayrer 16y ago
    That reply contains a rather petty ad hominem attack about the relevance of someone's security industry reputation. But I am interested in the argument about "responsible disclosure" damaging "the industry" is one I would like to hear. Since it's not hard to make, it should be easy to repeat. I'm not sure what "the industry" is here, though. Some other strange parts of the response: "The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them." Why accuse someone of pretending? I would not be surprised to find that you are right, but you should be able to point at data. Another problem is use of the passive voice: "product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's" Who gives them that latitude?
    - tptacek 16y ago
      Pointing out that people are willing to put their money where their mouths are, and that nobody in this particular message board has so far, is not ad hominem. If he's insulted to hear me point out that he's not a security researcher, I'm surprised. The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, Robert, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software.