4 ms·

That reply contains a rather petty ad hominem attack about the relevance of someone's security industry reputation. But I am interested in the argument about "

by sayrer 16y ago

That reply contains a rather petty ad hominem attack about the relevance of someone's security industry reputation. But I am interested in the argument about "responsible disclosure" damaging "the industry" is one I would like to hear. Since it's not hard to make, it should be easy to repeat. I'm not sure what "the industry" is here, though. Some other strange parts of the response: "The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them." Why accuse someone of pretending? I would not be surprised to find that you are right, but you should be able to point at data. Another problem is use of the passive voice: "product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's" Who gives them that latitude?

tptacek 16y ago
Pointing out that people are willing to put their money where their mouths are, and that nobody in this particular message board has so far, is not ad hominem. If he's insulted to hear me point out that he's not a security researcher, I'm surprised. The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, Robert, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software.
- sayrer 16y ago
  It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. You're still using the passive voice. It's not as if "product managers" are some well-defined group of people. For that matter, neither are "bona-fide security researchers". When I used the word "researcher" in scare quotes before, I wasn't trying to say this guy is quack. He obviously isn't. But using the word researcher is overblowing things. In reality, these guys are inspectors. They find real problems, and that is important, but very few of the problems they find are novel in nature. We do continually get the same types of defects reported, so something is wrong, but it has nothing to with reporting strategies. Change the way we write software--that would be actual research. The disclosure trade-offs you describe sound plausible, but don't account for the fact that an inspector may find an issue no one else has discovered. They are also backed up by zero data.
  - tptacek 16y ago
    "Product managers" are people who hold the title "product manager", and I've singled them out because they own the release schedule. Substitute whichever title you like. "Bona-fide researchers" are people who find and report flaws in good faith, as opposed to researchers who find flaws and sell them to organized crime. I use the term "bona-fide" because that's what it means: "good faith". I use the term "researcher" because that's the convention. That's not why you put scare quotes around the term. An infinitessimal fraction of all computer crime is ever seriously investigated. If you want hard stats, no argument I can make will satisfy you. I'm fine with that.
    - sayrer 16y ago
      1.) Product Managers don't own the release schedule. 2.) Ah, organized crime, but none of it is ever reported. Lack data much? For an "industry" that supposedly values transparency, the total absence of data seems odd. 3.) Why are you telling me why I put scare quotes around the term "researcher"? I told you why. I'm not lying.
      - deleted 16y ago

by sayrer 16y ago

tptacek 16y ago

Pointing out that people are willing to put their money where their mouths are, and that nobody in this particular message board has so far, is not ad hominem. If he's insulted to hear me point out that he's not a security researcher, I'm surprised. The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, Robert, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software.

sayrer 16y ago
It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. You're still using the passive voice. It's not as if "product managers" are some well-defined group of people. For that matter, neither are "bona-fide security researchers". When I used the word "researcher" in scare quotes before, I wasn't trying to say this guy is quack. He obviously isn't. But using the word researcher is overblowing things. In reality, these guys are inspectors. They find real problems, and that is important, but very few of the problems they find are novel in nature. We do continually get the same types of defects reported, so something is wrong, but it has nothing to with reporting strategies. Change the way we write software--that would be actual research. The disclosure trade-offs you describe sound plausible, but don't account for the fact that an inspector may find an issue no one else has discovered. They are also backed up by zero data.
- tptacek 16y ago
  "Product managers" are people who hold the title "product manager", and I've singled them out because they own the release schedule. Substitute whichever title you like. "Bona-fide researchers" are people who find and report flaws in good faith, as opposed to researchers who find flaws and sell them to organized crime. I use the term "bona-fide" because that's what it means: "good faith". I use the term "researcher" because that's the convention. That's not why you put scare quotes around the term. An infinitessimal fraction of all computer crime is ever seriously investigated. If you want hard stats, no argument I can make will satisfy you. I'm fine with that.
  - sayrer 16y ago
    1.) Product Managers don't own the release schedule. 2.) Ah, organized crime, but none of it is ever reported. Lack data much? For an "industry" that supposedly values transparency, the total absence of data seems odd. 3.) Why are you telling me why I put scare quotes around the term "researcher"? I told you why. I'm not lying.
    - deleted 16y ago