6 ms·

Yeah, I don't get this. The announcement on twitter contained zero information apart from "there's a remote code exec vulnerability on windows". Which I think y

Yeah, I don't get this. The announcement on twitter contained zero information apart from "there's a remote code exec vulnerability on windows". Which I think you could confidently say at ANY point in time (about ANY system). But Graham and others (https://twitter.com/taviso/status/861575086632968192 https://twitter.com/taviso/status/861575086632968192) continue to attack Tavis for announcing the fact that there is a known vulnerability. As if this somehow makes users more insecure. Surely it is better to alert people (and especially organisations) that a major security issue has been found so that they can be prepared to patch their systems as soon as a fix is released?

richmarr 9y ago
I know comparatively little about this stuff, so please excuse the question if it's dumb... If being alerted allows organisations to prepare to patch, surely it also allows malicious actors to prepare to exploit? My lay gut feeling is this seems more a trade-off in publicity between the announcing party and the software provider, both wanting to be seen with the initiative so that they look good.
- snowwolf 9y ago
  Malicious actors are far more proactive already about watching for security patches and reverse engineering them to work out how to exploit unpatched systems. Once a patch is released the cat is out the bag, and the only solution is to patch as quickly as possible.
- dom0 9y ago
  > surely it also allows malicious actors to prepare to exploit? "There is an RCE in Windows" is not helping anyone.
- sillysaurus3 9y ago
  This is a tangent, but: Isn't it strange that in security, it feels ok to give an uninformed opinion? I'm not calling you out -- quite the opposite. I like your comment because it admits to being uninformed. But for every comment like yours, there are dozens of tweets and HN comments that conceal their lay status while also having strong opinions. In the tech world, this seems unique to security. For example, none of us would feel like we should have a say in how Rust rolls forward unless we're experts in Rust, or at least involved in Rust in some way. Yet there are many who feel they should have a say in whether Project Zero ought to do X or Y even without any experience. I wonder why?
  - lol768 9y ago
    I'd guess that security feels pretty personal to a lot of people. They may not be experts in the area, but maybe they run servers,- deal with sensitive data or just don't want their personal machines compromised. A poor approach to vulnerability disclosure for a zero-day could cause them real issues, whereas perhaps a language design decision is less critical.
  - Angostura 9y ago
    I'm surprised you feel that way. Who here hasn't commented on an aspect of UI design, or UX, or Apple's roadmap or whether product X should be open source or comply with standard Z or whatever?
    - richmarr 9y ago
      In case anyone here hasn't heard it, this supposed trait of engineers of overconfidence on other topics is sometimes referred to as Engineer "Woo" http://rationalwiki.org/wiki/Engineers_and_woo http://rationalwiki.org/wiki/Engineers_and_woo
    - sillysaurus3 9y ago
      True, but as engineers, most of us have been at least peripherally involved in an aspect of UI design, or UX, or a product's roadmap, or choosing whether something should be open source or comply with a standard. But it seems like comparatively few of us have been involved with security in any way except perhaps doing our best not to write insecure code.
  - johncolanduoni 9y ago
    I don't think there's a difference in how willing people are to do it (e.g. I've definitely seen people who haven't touched Rust have strong opinions about it). However with security it's very easy to accidentally say something someone can show is clearly and unequivocally wrong, with decades of research in tow. A lot of other technical opinions on HN are ultimately up for debate. You see the same thing with physics and mathematics here fairly often: every time quantum computing comes up some people ask some good questions, and then a bunch of people give them confident and embarrassingly wrong answers. Finally others (including me sometimes) shout them down. It's just less noticeable because those subjects are rare here compared to information security; tptacek and others are constantly fighting the good fight.
captainmuon 9y ago
He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying to hack him, over bribing him, blackmailing him, serving him secret court orders, or even physically assaulting him with the famous wrench. Even if you are a seasoned security researcher, saying "I know how to get into any Windows PC by sending someone to a website" paints a huge target on you. Although the danger is kind of abstract, there is no security gain from tweeting about this, so I'd say he shouldn't have done it.
- caf 9y ago
  It's not worth millions if it's already been reported to Microsoft.
  - user5994461 9y ago
    Tell that to the millions of people who won't have the patch before next week.
    - dsp1234 9y ago
      Why would they not have it until next week. Per the advisory, the engine update is part of the normal windows defender updates, which happen up to 3 times daily. I just checked this morning, and I have the updated version already, and took no action. Those millions would have had to have disabled windows defender updates in order to not get this update before next week.
      - user5994461 9y ago
        It turns out the update is part of the Defender update, not windows update. That's a much more frequent schedule.
    - criley2 9y ago
      Not sure about millions but many do have update for Windows turned off, due to Microsoft's security-trust-destroying habit of deploying invasive and undesired non-security updates automatically. Windows 10 especially has a nasty streak with updates, and while security updates are smart, forcing new content updates, advertisements, and spyware into the Tuesday fast track teaches users that the only way to be safe from Microsoft is to not take software from them automatically.

richmarr 9y ago

I know comparatively little about this stuff, so please excuse the question if it's dumb... If being alerted allows organisations to prepare to patch, surely it also allows malicious actors to prepare to exploit? My lay gut feeling is this seems more a trade-off in publicity between the announcing party and the software provider, both wanting to be seen with the initiative so that they look good.

snowwolf 9y ago
Malicious actors are far more proactive already about watching for security patches and reverse engineering them to work out how to exploit unpatched systems. Once a patch is released the cat is out the bag, and the only solution is to patch as quickly as possible.
dom0 9y ago
> surely it also allows malicious actors to prepare to exploit? "There is an RCE in Windows" is not helping anyone.
sillysaurus3 9y ago
This is a tangent, but: Isn't it strange that in security, it feels ok to give an uninformed opinion? I'm not calling you out -- quite the opposite. I like your comment because it admits to being uninformed. But for every comment like yours, there are dozens of tweets and HN comments that conceal their lay status while also having strong opinions. In the tech world, this seems unique to security. For example, none of us would feel like we should have a say in how Rust rolls forward unless we're experts in Rust, or at least involved in Rust in some way. Yet there are many who feel they should have a say in whether Project Zero ought to do X or Y even without any experience. I wonder why?
- lol768 9y ago
  I'd guess that security feels pretty personal to a lot of people. They may not be experts in the area, but maybe they run servers,- deal with sensitive data or just don't want their personal machines compromised. A poor approach to vulnerability disclosure for a zero-day could cause them real issues, whereas perhaps a language design decision is less critical.
- Angostura 9y ago
  I'm surprised you feel that way. Who here hasn't commented on an aspect of UI design, or UX, or Apple's roadmap or whether product X should be open source or comply with standard Z or whatever?
  - richmarr 9y ago
    In case anyone here hasn't heard it, this supposed trait of engineers of overconfidence on other topics is sometimes referred to as Engineer "Woo" http://rationalwiki.org/wiki/Engineers_and_woo http://rationalwiki.org/wiki/Engineers_and_woo
  - sillysaurus3 9y ago
    True, but as engineers, most of us have been at least peripherally involved in an aspect of UI design, or UX, or a product's roadmap, or choosing whether something should be open source or comply with a standard. But it seems like comparatively few of us have been involved with security in any way except perhaps doing our best not to write insecure code.
- johncolanduoni 9y ago
  I don't think there's a difference in how willing people are to do it (e.g. I've definitely seen people who haven't touched Rust have strong opinions about it). However with security it's very easy to accidentally say something someone can show is clearly and unequivocally wrong, with decades of research in tow. A lot of other technical opinions on HN are ultimately up for debate. You see the same thing with physics and mathematics here fairly often: every time quantum computing comes up some people ask some good questions, and then a bunch of people give them confident and embarrassingly wrong answers. Finally others (including me sometimes) shout them down. It's just less noticeable because those subjects are rare here compared to information security; tptacek and others are constantly fighting the good fight.

captainmuon 9y ago

He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying to hack him, over bribing him, blackmailing him, serving him secret court orders, or even physically assaulting him with the famous wrench. Even if you are a seasoned security researcher, saying "I know how to get into any Windows PC by sending someone to a website" paints a huge target on you. Although the danger is kind of abstract, there is no security gain from tweeting about this, so I'd say he shouldn't have done it.

caf 9y ago
It's not worth millions if it's already been reported to Microsoft.
- user5994461 9y ago
  Tell that to the millions of people who won't have the patch before next week.
  - dsp1234 9y ago
    Why would they not have it until next week. Per the advisory, the engine update is part of the normal windows defender updates, which happen up to 3 times daily. I just checked this morning, and I have the updated version already, and took no action. Those millions would have had to have disabled windows defender updates in order to not get this update before next week.
    - user5994461 9y ago
      It turns out the update is part of the Defender update, not windows update. That's a much more frequent schedule.
  - criley2 9y ago
    Not sure about millions but many do have update for Windows turned off, due to Microsoft's security-trust-destroying habit of deploying invasive and undesired non-security updates automatically. Windows 10 especially has a nasty streak with updates, and while security updates are smart, forcing new content updates, advertisements, and spyware into the Tuesday fast track teaches users that the only way to be safe from Microsoft is to not take software from them automatically.