5 ms·

There are many sides to this and you're generalizing it to people not understanding the full value of security disclosure is misleading. I can assure you a lot

There are many sides to this and you're generalizing it to people not understanding the full value of security disclosure is misleading. I can assure you a lot of those people fully understand the value of security disclosures and they are for it. What many people have the problem with, is with Tavis' tone and his approach to announcing his findings. No reasonable security researchers find a bug, announce it first to Twitter or other mass public postings and then inform affected vendor(s) with the disclosures. That's not it should be done and it is not a responsible discourse policy, this is what people have problems with Tavis. Tavis is doing amazing work, work that we need but he has to be careful with how he announce his findings to the public.

mikeash 9y ago
What's wrong with an announcement like this? With literally no details, it's not helping bad guys (or, for that matter, good guys). I can see an argument that it's unprofessional to call out a company when you need them on your side. But is anyone making that argument? All the negative replies I saw to that tweet, for example, are along the lines of "omg you ruined my weekend why couldn't you wait until Monday?"
- mikhailt 9y ago
  Not this tweet specifically, look at the tweets he did in the past where he did point out the names such as LastPass and 1Password. It caused some folks to contact these vendors for more information where they don't have any yet at the time of the tweets. Like this one: https://mobile.twitter.com/taviso/status/760231214812844032 https://mobile.twitter.com/taviso/status/760231214812844032 Or https://mobile.twitter.com/taviso/status/845717082717114368 https://mobile.twitter.com/taviso/status/845717082717114368
  - mikeash 9y ago
    How is that different from pointing out a name like Microsoft? Either way, it might be uncouth, but I don't see the connection to responsible disclosure.
    - mikhailt 9y ago
      It's not me that is having a problem with this, I'm just pointing out why some people are having problems with Tavis in general. You don't think it is reasonable to at least tell a vendor there is a security problem first before telling the rest of the world? Maybe responsible disclosure is the wrong name for this, I like the coordinated disclosure idea better. Maybe I am using the wrong terms but I cannot edit my post anymore.
      - mikeash 9y ago
        I think it's reasonable to tell the vendor first. I don't think it's reasonable to freak out about a general, detail-free announcement, and especially not with "omg there goes my weekend" and "you're helping the bad guys" nonsense. The mere announcement of the existence of a bug, with little enough detail that it won't help anyone find it (i.e. "RCE in Windows" is useless), does no practical harm. It might be a bit rude. It's the announcement of details that help people find the bug that hurts. If the original announcement was "RCE in Windows due to type error in malware protection JavaScript interpreter" then that would potentially help bad guys put together an exploit before good guys can release a patch. Stuff like responsible disclosure (coordinated disclosure would be a fine term too) is about the second one, only, as far as I understand it. It's about mitigating the practical effects of the vulnerability as much as possible, not about protecting the reputation of the company or avoiding rudeness.
syshum 9y ago
As a supporter of Full Disclosure I believe it is irresponsible to follow the so called "Responsible" disclosure model. I dont believe it is "responsible" to leave people exposed for 90+ days while the vendor attempts to whitewash and cover up their vulnerabilities as it so often the case. While some software vendors might respond the vulnerabilities properly, most do not often wanting to blame shit, or even file legal action against anyone discovering vulnerabilities.
- CiPHPerCoder 9y ago
  The term "responsible disclosure" is actually a bad term to use, even if you support it: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is... TL;DR "coordinated disclosure" is preferred.
- mikhailt 9y ago
  It depends on the situation but I agree with the better name for this, coordinated disclosure. If the vendor refuses to do anything, then yes, the 90 days should be waived. I'm not saying we shouldn't disclose at all, I'm saying the vendors have the right to have the info first and react before the said announcements start.

mikeash 9y ago

What's wrong with an announcement like this? With literally no details, it's not helping bad guys (or, for that matter, good guys). I can see an argument that it's unprofessional to call out a company when you need them on your side. But is anyone making that argument? All the negative replies I saw to that tweet, for example, are along the lines of "omg you ruined my weekend why couldn't you wait until Monday?"

mikhailt 9y ago
Not this tweet specifically, look at the tweets he did in the past where he did point out the names such as LastPass and 1Password. It caused some folks to contact these vendors for more information where they don't have any yet at the time of the tweets. Like this one: https://mobile.twitter.com/taviso/status/760231214812844032 https://mobile.twitter.com/taviso/status/760231214812844032 Or https://mobile.twitter.com/taviso/status/845717082717114368 https://mobile.twitter.com/taviso/status/845717082717114368
- mikeash 9y ago
  How is that different from pointing out a name like Microsoft? Either way, it might be uncouth, but I don't see the connection to responsible disclosure.
  - mikhailt 9y ago
    It's not me that is having a problem with this, I'm just pointing out why some people are having problems with Tavis in general. You don't think it is reasonable to at least tell a vendor there is a security problem first before telling the rest of the world? Maybe responsible disclosure is the wrong name for this, I like the coordinated disclosure idea better. Maybe I am using the wrong terms but I cannot edit my post anymore.
    - mikeash 9y ago
      I think it's reasonable to tell the vendor first. I don't think it's reasonable to freak out about a general, detail-free announcement, and especially not with "omg there goes my weekend" and "you're helping the bad guys" nonsense. The mere announcement of the existence of a bug, with little enough detail that it won't help anyone find it (i.e. "RCE in Windows" is useless), does no practical harm. It might be a bit rude. It's the announcement of details that help people find the bug that hurts. If the original announcement was "RCE in Windows due to type error in malware protection JavaScript interpreter" then that would potentially help bad guys put together an exploit before good guys can release a patch. Stuff like responsible disclosure (coordinated disclosure would be a fine term too) is about the second one, only, as far as I understand it. It's about mitigating the practical effects of the vulnerability as much as possible, not about protecting the reputation of the company or avoiding rudeness.

syshum 9y ago

As a supporter of Full Disclosure I believe it is irresponsible to follow the so called "Responsible" disclosure model. I dont believe it is "responsible" to leave people exposed for 90+ days while the vendor attempts to whitewash and cover up their vulnerabilities as it so often the case. While some software vendors might respond the vulnerabilities properly, most do not often wanting to blame shit, or even file legal action against anyone discovering vulnerabilities.

CiPHPerCoder 9y ago
The term "responsible disclosure" is actually a bad term to use, even if you support it: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is... TL;DR "coordinated disclosure" is preferred.
mikhailt 9y ago
It depends on the situation but I agree with the better name for this, coordinated disclosure. If the vendor refuses to do anything, then yes, the 90 days should be waived. I'm not saying we shouldn't disclose at all, I'm saying the vendors have the right to have the info first and react before the said announcements start.