4 ms·

If I remember correctly, the vulnerability already being exploited at the time of the announcement was the reason Tavis gave for faster-than-usual disclosure.

by andreyf 16y ago

If I remember correctly, the vulnerability already being exploited at the time of the announcement was the reason Tavis gave for faster-than-usual disclosure. Edit: the exact quote was "I've concluded that there's a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security", from http://threatpost.com/en_us/blogs/googler-drops-windows-zero-day-microsoft-unhappy-061010 http://threatpost.com/en_us/blogs/googler-drops-windows-zero...

tptacek 16y ago
While I'm virtually certain that Tavis acted in good faith here, there is a huge difference between his inference that it was likely this bug had been found and actual evidence demonstrating it.
- Groxx 16y ago
  How would one go about finding evidence that an undisclosed bug is being exploited? (both a serious question and a bit of snark. Seems like it'd be pretty hard for an individual to gather actual evidence, unless it were used on them)
btilly 16y ago
More than that, if you read http://twitter.com/taviso http://twitter.com/taviso you'll find the comment I'm getting pretty tired of all the "5 days" hate mail. Those five days were spent trying to negotiate a fix within 60 days. The fact that Microsoft knew about the problem and was unwilling to release a fix inside of 60 days when pushed is good reason to disclose. That way the NEXT time he reports a bug to them, there is a better chance that they'll actually act.
- InclinedPlane 16y ago
  There's a particularly pervasive anti-pattern in development of focusing on treating the symptom instead of the root-cause. The worst cases of this extend all the way to developing an adversarial relationship with testers and bug-filers (adopting a "shoot the messenger" stance). This usually happens gradually enough so that people don't realize they are doing it. Camaraderie devolves into tribalism and groupthink, criticism from outsiders is denigrated and ignored. And then cold, harsh reality intervenes resulting in disaster that should have come as a surprise to no one.

by andreyf 16y ago

tptacek 16y ago

While I'm virtually certain that Tavis acted in good faith here, there is a huge difference between his inference that it was likely this bug had been found and actual evidence demonstrating it.

Groxx 16y ago
How would one go about finding evidence that an undisclosed bug is being exploited? (both a serious question and a bit of snark. Seems like it'd be pretty hard for an individual to gather actual evidence, unless it were used on them)

btilly 16y ago

More than that, if you read http://twitter.com/taviso http://twitter.com/taviso you'll find the comment I'm getting pretty tired of all the "5 days" hate mail. Those five days were spent trying to negotiate a fix within 60 days. The fact that Microsoft knew about the problem and was unwilling to release a fix inside of 60 days when pushed is good reason to disclose. That way the NEXT time he reports a bug to them, there is a better chance that they'll actually act.

InclinedPlane 16y ago
There's a particularly pervasive anti-pattern in development of focusing on treating the symptom instead of the root-cause. The worst cases of this extend all the way to developing an adversarial relationship with testers and bug-filers (adopting a "shoot the messenger" stance). This usually happens gradually enough so that people don't realize they are doing it. Camaraderie devolves into tribalism and groupthink, criticism from outsiders is denigrated and ignored. And then cold, harsh reality intervenes resulting in disaster that should have come as a surprise to no one.