4 ms·

He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying t

He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying to hack him, over bribing him, blackmailing him, serving him secret court orders, or even physically assaulting him with the famous wrench. Even if you are a seasoned security researcher, saying "I know how to get into any Windows PC by sending someone to a website" paints a huge target on you. Although the danger is kind of abstract, there is no security gain from tweeting about this, so I'd say he shouldn't have done it.

caf 9y ago
It's not worth millions if it's already been reported to Microsoft.
- user5994461 9y ago
  Tell that to the millions of people who won't have the patch before next week.
  - dsp1234 9y ago
    Why would they not have it until next week. Per the advisory, the engine update is part of the normal windows defender updates, which happen up to 3 times daily. I just checked this morning, and I have the updated version already, and took no action. Those millions would have had to have disabled windows defender updates in order to not get this update before next week.
    - user5994461 9y ago
      It turns out the update is part of the Defender update, not windows update. That's a much more frequent schedule.
  - criley2 9y ago
    Not sure about millions but many do have update for Windows turned off, due to Microsoft's security-trust-destroying habit of deploying invasive and undesired non-security updates automatically. Windows 10 especially has a nasty streak with updates, and while security updates are smart, forcing new content updates, advertisements, and spyware into the Tuesday fast track teaches users that the only way to be safe from Microsoft is to not take software from them automatically.
    - scopecreep 9y ago
      File this one under "play stupid games - win stupid prizes". Idiots like this are why Windows updates are completely forced in the first place. A couple generations of "experts" knew better and refused to let Windows update. Then billions of dollars were lost cleaning up worms that had already been patched, but people kept canceling the update dialog. See SqlSlammer, CodeRed, etc. You had your chance to handle your own updates and proved that you cannot be trusted to do so. This is the next logical step.
      - Pica_soO 9y ago
        Yes, if one wants safety, one got to be unsafe regarding the company who provides the infrastructure one paid for. One either has Internal-Adds or Internet-Aids. Or both. One could of course get tarred and feathered until one looks like a penguin - but hey, who is that desperate. Lets ask that question again, the day such a exploit is rolled out world wide with a patch on his back. Funny times. Microsoft recommends for all HN Readers: Spam musubi - buy the delicious Hawaian delacay now. In a store near you! Get a free sample with this Coupon-Code: 0xDEADBEEF
      - criley2 9y ago
        "You had your chance to handle your own updates and proved that you cannot be trusted to do so. This is the next logical step." Personally, I would describe the user voluntarily allowing their computer to become infested with first party adware and spyware as winning the stupid prize, but your mileage may vary.
- deleted 9y ago
  [deleted]
lawnchair_larry 9y ago
That's nonsense, and nobody would pay millions for this bug. What he did was really of no consequence at all.
snowwolf 9y ago
I'd maybe disagree that there is "no security gain from tweeting about this". I think there is a security gain from warning people that an urgent security patch is on the way so they should prepare themselves/their organisation to deploy the patch as soon as it lands. Now you could argue that a personal twitter account is not the best medium for this warning (maybe it should come directly from Google Project Zero or Microsoft), but Tavis does have a large sphere of influence, and I invariably hear about these things through him than via other sources so it is an effective medium. Edit: Note, the argument here is whether his initial tweet (https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080) constitutes disclosure - I don't think it does. The actual disclosure was handled according to Google Project Zero's policies.
- throwaway890723 9y ago
  At he end of the day you have to ask yourself if it's worth it. Security is a touchy topics and that's probably how you want it. Yes, you can argue that you're right, even objectively so, but there's going to be people who disagree. There only so much karma you can burn through before people, and often the people who are the most serious about it, leaves for some other route. And then you sit there ten years later and wonder why "people don't care". You want to announce upcoming vulnerabilities, fine, do that. Be up front about it and make an argument for it so people see your motivations. Don't leave people guessing what's going to happen based on the mood of the day.
jk563 9y ago
It's more of "I knew how to get into any Windows PC by sending someone to a website, but it's already been patched" Much less desirable.
- shawnz 9y ago
  4 days ago when he posted about its existence on twitter, it hadn't been patched.
  - Operyl 9y ago
    But the vendor was aware of the issue, and was already getting their ducks in a row. So it was largely useless to any adversary.
pvg 9y ago
He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying to hack him, over bribing him, blackmailing him, serving him secret court orders, or even physically assaulting him with the famous wrench. It's not a secret worth millions and nobody does any of that stuff for Windows RCE vulnerabilities.

caf 9y ago

It's not worth millions if it's already been reported to Microsoft.

user5994461 9y ago
Tell that to the millions of people who won't have the patch before next week.
- dsp1234 9y ago
  Why would they not have it until next week. Per the advisory, the engine update is part of the normal windows defender updates, which happen up to 3 times daily. I just checked this morning, and I have the updated version already, and took no action. Those millions would have had to have disabled windows defender updates in order to not get this update before next week.
  - user5994461 9y ago
    It turns out the update is part of the Defender update, not windows update. That's a much more frequent schedule.
- criley2 9y ago
  Not sure about millions but many do have update for Windows turned off, due to Microsoft's security-trust-destroying habit of deploying invasive and undesired non-security updates automatically. Windows 10 especially has a nasty streak with updates, and while security updates are smart, forcing new content updates, advertisements, and spyware into the Tuesday fast track teaches users that the only way to be safe from Microsoft is to not take software from them automatically.
  - scopecreep 9y ago
    File this one under "play stupid games - win stupid prizes". Idiots like this are why Windows updates are completely forced in the first place. A couple generations of "experts" knew better and refused to let Windows update. Then billions of dollars were lost cleaning up worms that had already been patched, but people kept canceling the update dialog. See SqlSlammer, CodeRed, etc. You had your chance to handle your own updates and proved that you cannot be trusted to do so. This is the next logical step.
    - Pica_soO 9y ago
      Yes, if one wants safety, one got to be unsafe regarding the company who provides the infrastructure one paid for. One either has Internal-Adds or Internet-Aids. Or both. One could of course get tarred and feathered until one looks like a penguin - but hey, who is that desperate. Lets ask that question again, the day such a exploit is rolled out world wide with a patch on his back. Funny times. Microsoft recommends for all HN Readers: Spam musubi - buy the delicious Hawaian delacay now. In a store near you! Get a free sample with this Coupon-Code: 0xDEADBEEF
    - criley2 9y ago
      "You had your chance to handle your own updates and proved that you cannot be trusted to do so. This is the next logical step." Personally, I would describe the user voluntarily allowing their computer to become infested with first party adware and spyware as winning the stupid prize, but your mileage may vary.
deleted 9y ago
[deleted]

lawnchair_larry 9y ago

That's nonsense, and nobody would pay millions for this bug. What he did was really of no consequence at all.

snowwolf 9y ago

I'd maybe disagree that there is "no security gain from tweeting about this". I think there is a security gain from warning people that an urgent security patch is on the way so they should prepare themselves/their organisation to deploy the patch as soon as it lands. Now you could argue that a personal twitter account is not the best medium for this warning (maybe it should come directly from Google Project Zero or Microsoft), but Tavis does have a large sphere of influence, and I invariably hear about these things through him than via other sources so it is an effective medium. Edit: Note, the argument here is whether his initial tweet (https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080) constitutes disclosure - I don't think it does. The actual disclosure was handled according to Google Project Zero's policies.

throwaway890723 9y ago
At he end of the day you have to ask yourself if it's worth it. Security is a touchy topics and that's probably how you want it. Yes, you can argue that you're right, even objectively so, but there's going to be people who disagree. There only so much karma you can burn through before people, and often the people who are the most serious about it, leaves for some other route. And then you sit there ten years later and wonder why "people don't care". You want to announce upcoming vulnerabilities, fine, do that. Be up front about it and make an argument for it so people see your motivations. Don't leave people guessing what's going to happen based on the mood of the day.

jk563 9y ago

It's more of "I knew how to get into any Windows PC by sending someone to a website, but it's already been patched" Much less desirable.

shawnz 9y ago
4 days ago when he posted about its existence on twitter, it hadn't been patched.
- Operyl 9y ago
  But the vendor was aware of the issue, and was already getting their ducks in a row. So it was largely useless to any adversary.

pvg 9y ago