4 ms·

Malicious actors may find the vulnerability just like researchers did, so if the issue is not being fixed, the only responsible thing is to inform everyone of t

by Jare 9y ago

Malicious actors may find the vulnerability just like researchers did, so if the issue is not being fixed, the only responsible thing is to inform everyone of the potential danger they _already_ are in, and let them decide. The bells & whistles of giving it a fancy name, domain, etc suggest an additional layer of intent with the disclosure, but that's a separate issue because they have followed reasonable procedures beforehand.

etjossem 9y ago
Malicious actors and users will be alerted in equal measure, but the typical Android phone owner will tend to do nothing in response to a new security paper, while malicious actors will tend to write exploit scripts. That's the main concern going through my mind when I see this. It would be different if the average user was a business, a developer, a security professional - but this isn't Heartbleed and we're talking about normal people this time. Are they even going to read this, and if so, what can they do besides keep an eye on their permissions?
- Jare 9y ago
  > Malicious actors and users will be alerted in equal measure You have to assume malicious actors will find the vulnerability on their own, if they haven't already. They are already alerted.
  - etjossem 9y ago
    Absolutely, but widespread disclosure does nothing to stop that from happening, and may actually enable less-sophisticated attackers to do things they weren't capable of before.
    - AstralStorm 9y ago
      Assuming those less sophisticated attackers don't just buy the exploit from more sophisticated ones.
- plaguuuuuu 9y ago
  >but the typical Android phone owner will tend to do nothing in response to a new security paper, while malicious actors will tend to write exploit scripts. If there are enough open, unpatched exploits people will switch to other phone vendors.
  - crazyhatfish 9y ago
    I seriously doubt that. Some sources have use of WinXP at 7 percent, it should be zero, and there are plenty of open, unpatched exploits for WinXP.

by Jare 9y ago

etjossem 9y ago

Malicious actors and users will be alerted in equal measure, but the typical Android phone owner will tend to do nothing in response to a new security paper, while malicious actors will tend to write exploit scripts. That's the main concern going through my mind when I see this. It would be different if the average user was a business, a developer, a security professional - but this isn't Heartbleed and we're talking about normal people this time. Are they even going to read this, and if so, what can they do besides keep an eye on their permissions?

Jare 9y ago
> Malicious actors and users will be alerted in equal measure You have to assume malicious actors will find the vulnerability on their own, if they haven't already. They are already alerted.
- etjossem 9y ago
  Absolutely, but widespread disclosure does nothing to stop that from happening, and may actually enable less-sophisticated attackers to do things they weren't capable of before.
  - AstralStorm 9y ago
    Assuming those less sophisticated attackers don't just buy the exploit from more sophisticated ones.
plaguuuuuu 9y ago
>but the typical Android phone owner will tend to do nothing in response to a new security paper, while malicious actors will tend to write exploit scripts. If there are enough open, unpatched exploits people will switch to other phone vendors.
- crazyhatfish 9y ago
  I seriously doubt that. Some sources have use of WinXP at 7 percent, it should be zero, and there are plenty of open, unpatched exploits for WinXP.