3 ms·

It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. You're still using the passive voice. It's

by sayrer 16y ago

It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. You're still using the passive voice. It's not as if "product managers" are some well-defined group of people. For that matter, neither are "bona-fide security researchers". When I used the word "researcher" in scare quotes before, I wasn't trying to say this guy is quack. He obviously isn't. But using the word researcher is overblowing things. In reality, these guys are inspectors. They find real problems, and that is important, but very few of the problems they find are novel in nature. We do continually get the same types of defects reported, so something is wrong, but it has nothing to with reporting strategies. Change the way we write software--that would be actual research. The disclosure trade-offs you describe sound plausible, but don't account for the fact that an inspector may find an issue no one else has discovered. They are also backed up by zero data.

tptacek 16y ago
"Product managers" are people who hold the title "product manager", and I've singled them out because they own the release schedule. Substitute whichever title you like. "Bona-fide researchers" are people who find and report flaws in good faith, as opposed to researchers who find flaws and sell them to organized crime. I use the term "bona-fide" because that's what it means: "good faith". I use the term "researcher" because that's the convention. That's not why you put scare quotes around the term. An infinitessimal fraction of all computer crime is ever seriously investigated. If you want hard stats, no argument I can make will satisfy you. I'm fine with that.
- sayrer 16y ago
  1.) Product Managers don't own the release schedule. 2.) Ah, organized crime, but none of it is ever reported. Lack data much? For an "industry" that supposedly values transparency, the total absence of data seems odd. 3.) Why are you telling me why I put scare quotes around the term "researcher"? I told you why. I'm not lying.
  - deleted 16y ago
    [deleted]
  - Natsu 16y ago
    1 & 3) I find it curious that you feel free to define your own meaning for scare quotes, but have a problem with him defining "product manager" as "the person who owns the release schedule." I think Lewis Carroll wrote about how that works: http://en.wikipedia.org/wiki/Humpty_Dumpty#In_Through_the_Looking-Glass http://en.wikipedia.org/wiki/Humpty_Dumpty#In_Through_the_Lo... 2) You won't find that kind of news on CNN, but it's out there if you know where to look. Try DarkReading or F-Secure's blog, just to get started. There are many botnets out there right now. Even some controlled by Russian mobsters. There are places where you can buy, sell & trade credit card numbers. There's a TON of crime out there, but for people who don't deal with it, all you hear is the occasional, "Company X had a data breach affecting approximately Y users. A company spokesman wants to assure you that everything is all right and that the very same company that allowed this breech to happen will make sure that it quickly vanishes from the public eye." Finally, you don't know Thomas as you indicated in a post further up, you might want to read this: http://www.darkreading.com/security/management/showArticle.jhtml?articleID=208804717 http://www.darkreading.com/security/management/showArticle.j... In case you're wondering, it's really not uncommon for people who deal with computer security to take the time to find out who they're talking to online. You might be surprised at how often it proves useful. And I'm practicing what I preach here, because I only know him by reputation.
  - jbz 16y ago
    For what its worth in my experience in enterprise administration for a 10,000+ computer network at one company, and a 4,000+ computer network at another, computer crime is _never_ reported, rarely receives a cursory investigation, and a full investigation is forbidden by policy. I define computer crime as a successful network intrusion where an attacker gains access to the internal network, which occurs at a frighteningly high level.
elblanco 16y ago
> It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. It's making me feel weird as well.

by sayrer 16y ago

tptacek 16y ago

"Product managers" are people who hold the title "product manager", and I've singled them out because they own the release schedule. Substitute whichever title you like. "Bona-fide researchers" are people who find and report flaws in good faith, as opposed to researchers who find flaws and sell them to organized crime. I use the term "bona-fide" because that's what it means: "good faith". I use the term "researcher" because that's the convention. That's not why you put scare quotes around the term. An infinitessimal fraction of all computer crime is ever seriously investigated. If you want hard stats, no argument I can make will satisfy you. I'm fine with that.

sayrer 16y ago
1.) Product Managers don't own the release schedule. 2.) Ah, organized crime, but none of it is ever reported. Lack data much? For an "industry" that supposedly values transparency, the total absence of data seems odd. 3.) Why are you telling me why I put scare quotes around the term "researcher"? I told you why. I'm not lying.
- deleted 16y ago
  [deleted]
- Natsu 16y ago
  1 & 3) I find it curious that you feel free to define your own meaning for scare quotes, but have a problem with him defining "product manager" as "the person who owns the release schedule." I think Lewis Carroll wrote about how that works: http://en.wikipedia.org/wiki/Humpty_Dumpty#In_Through_the_Looking-Glass http://en.wikipedia.org/wiki/Humpty_Dumpty#In_Through_the_Lo... 2) You won't find that kind of news on CNN, but it's out there if you know where to look. Try DarkReading or F-Secure's blog, just to get started. There are many botnets out there right now. Even some controlled by Russian mobsters. There are places where you can buy, sell & trade credit card numbers. There's a TON of crime out there, but for people who don't deal with it, all you hear is the occasional, "Company X had a data breach affecting approximately Y users. A company spokesman wants to assure you that everything is all right and that the very same company that allowed this breech to happen will make sure that it quickly vanishes from the public eye." Finally, you don't know Thomas as you indicated in a post further up, you might want to read this: http://www.darkreading.com/security/management/showArticle.jhtml?articleID=208804717 http://www.darkreading.com/security/management/showArticle.j... In case you're wondering, it's really not uncommon for people who deal with computer security to take the time to find out who they're talking to online. You might be surprised at how often it proves useful. And I'm practicing what I preach here, because I only know him by reputation.
- jbz 16y ago
  For what its worth in my experience in enterprise administration for a 10,000+ computer network at one company, and a 4,000+ computer network at another, computer crime is _never_ reported, rarely receives a cursory investigation, and a full investigation is forbidden by policy. I define computer crime as a successful network intrusion where an attacker gains access to the internal network, which occurs at a frighteningly high level.

elblanco 16y ago

> It seems weird that you use my first name in your comments. My name is not a secret, but I barely know who you are. It's making me feel weird as well.