3 ms·

Like it or not, the average smartphone user's security is at the mercy of their vendor. The pace and priority of updates is not up to the typical device owner,

Like it or not, the average smartphone user's security is at the mercy of their vendor. The pace and priority of updates is not up to the typical device owner, nor do security researchers have any say - it's up to Apple and Google. Fully exposing flaws in the software they write can have a real impact on millions of people who don't have much of an alternative. If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you have made things less safe for security-unaware users. There's no way around that. You already gave the vendor the opportunity to fix the problem. Now you are giving attackers the tools they need to take advantage of it. You and I might care about abstract principles of corporate responsibility, but the typical user just wants to avoid getting phished, and I can't help but feel open disclosure has a lot of potential to harm them. I hope it's worth it.

sgift 9y ago
> If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you are amplifying the current harm it's inflicting. At least the public now has a fair chance to evaluate if they want to use their devices despite this vulnerabilities.
- etjossem 9y ago
  That's true, but it glibly ignores the reality of vendor lock-in. The average non-infosec human is not going to switch devices because of a vulnerability whitepaper. This "vuln-insensitive user" is better served by giving the vendor a longer timeline to take care of the issue, rather than releasing exploit details two weeks after someone changed a status on a ticket.
  - AstralStorm 9y ago
    Then fight the lock-in, in court if necessary. Tort lawyer will have some fun with it if you can show you cannot evade losses of secure data. I am pretty sure the line of defence will be weak "no warranty" claim that has nothing to do with lock in.
- chipperyman573 9y ago
  I feel that this rebuttle is silly. Nobody outside HN (and similar) will understand what this means. And, even if they do, many users cannot afford to buy an iPhone (the only real competition) just because of one security flaw that might affect them. Even then, the opportunity cost of switching is not minimal.
  - ocdtrekkie 9y ago
    The fact that the only competition is unaffordable to a product with 85% global market share is a strong indicator we need to bust a monopoly for the public interest.
    - amygdyl 9y ago
      I wonder if Apple was perceived to be playing a security first product approach, whether this same audience would not be able to find a far more forgiving view of the Apple price list?
tptacek 9y ago
I don't really care what you believe about this stuff --- you're entitled to your opinions! --- as long as we're clear that people probably shouldn't be perpetuating the term "responsible disclosure".
- etjossem 9y ago
  And I don't really care what you call this stuff! "Coordinated disclosure" is a good value-neutral term and I appreciate the reasons why you prefer it. I'm just trying to get a discussion going on which approach, if any, is most responsible (lowercase).
csydas 9y ago
At the same time, it's a real "damned if you do, damned if you don't" situation, isn't it? It is well documented that vulnerabilities are traded and sold freely online at various forums; since this isn't really a 0-day or an exploit as much as it is a new spin on a classic trick, there's no value in malicious actors hoarding the secret, especially since it's mostly a social engineering trick not an actual exploit. In this particular case, the weight of the options seems to be "Make key users aware and put public pressure on vendors at the cost of giving a few bad actors an idea they didn't have before" versus "prevent giving a few more bad actors a new idea at the cost of Users being in the dark and vendors having no reason to address the issue" The cost in this case seems pretty minimal, given that I'd assume there's no reason to really hang onto such a tactic. For other exploits, it's basically the same idea: Who has the exploit, how likely is it that it's been sold, is the vendor likely to do anything about it, how dangerous is it to users? In most cases, if the exploit is already known and used among bad actors freely, what benefit is there to users in keeping such exploits hidden just to prevent a few more bad actors from doing it as well? Just seems like if the house is on fire, there's no sense in worrying about the wallpaper. (paraphrasing the quote since I can't remember its origin)

sgift 9y ago

> If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you are amplifying the current harm it's inflicting. At least the public now has a fair chance to evaluate if they want to use their devices despite this vulnerabilities.

etjossem 9y ago
That's true, but it glibly ignores the reality of vendor lock-in. The average non-infosec human is not going to switch devices because of a vulnerability whitepaper. This "vuln-insensitive user" is better served by giving the vendor a longer timeline to take care of the issue, rather than releasing exploit details two weeks after someone changed a status on a ticket.
- AstralStorm 9y ago
  Then fight the lock-in, in court if necessary. Tort lawyer will have some fun with it if you can show you cannot evade losses of secure data. I am pretty sure the line of defence will be weak "no warranty" claim that has nothing to do with lock in.
chipperyman573 9y ago
I feel that this rebuttle is silly. Nobody outside HN (and similar) will understand what this means. And, even if they do, many users cannot afford to buy an iPhone (the only real competition) just because of one security flaw that might affect them. Even then, the opportunity cost of switching is not minimal.
- ocdtrekkie 9y ago
  The fact that the only competition is unaffordable to a product with 85% global market share is a strong indicator we need to bust a monopoly for the public interest.
  - amygdyl 9y ago
    I wonder if Apple was perceived to be playing a security first product approach, whether this same audience would not be able to find a far more forgiving view of the Apple price list?

tptacek 9y ago

I don't really care what you believe about this stuff --- you're entitled to your opinions! --- as long as we're clear that people probably shouldn't be perpetuating the term "responsible disclosure".

etjossem 9y ago
And I don't really care what you call this stuff! "Coordinated disclosure" is a good value-neutral term and I appreciate the reasons why you prefer it. I'm just trying to get a discussion going on which approach, if any, is most responsible (lowercase).

csydas 9y ago

At the same time, it's a real "damned if you do, damned if you don't" situation, isn't it? It is well documented that vulnerabilities are traded and sold freely online at various forums; since this isn't really a 0-day or an exploit as much as it is a new spin on a classic trick, there's no value in malicious actors hoarding the secret, especially since it's mostly a social engineering trick not an actual exploit. In this particular case, the weight of the options seems to be "Make key users aware and put public pressure on vendors at the cost of giving a few bad actors an idea they didn't have before" versus "prevent giving a few more bad actors a new idea at the cost of Users being in the dark and vendors having no reason to address the issue" The cost in this case seems pretty minimal, given that I'd assume there's no reason to really hang onto such a tactic. For other exploits, it's basically the same idea: Who has the exploit, how likely is it that it's been sold, is the vendor likely to do anything about it, how dangerous is it to users? In most cases, if the exploit is already known and used among bad actors freely, what benefit is there to users in keeping such exploits hidden just to prevent a few more bad actors from doing it as well? Just seems like if the house is on fire, there's no sense in worrying about the wallpaper. (paraphrasing the quote since I can't remember its origin)