4 ms·

„submitted for review on 19 May 2017“ ... „OpenBSD was notified of the vulnerability on 15 July 2017“ Can anyone explain the timeline of releasing such signifi

„submitted for review on 19 May 2017“ ... „OpenBSD was notified of the vulnerability on 15 July 2017“ Can anyone explain the timeline of releasing such significant security findings? Why is it disclosed to the public 1/2 year after submitting to review? I'd guess the (publicly funded) research behind it is a lot older than that.

grabcocque 9y ago
For a vulnerability of this magnitude, it's not unusual for a responsible disclosure to have a five month review window. e.g. Dan Kaminsky's discovery of DNS cache poisoning had a 5 month responsible disclosure embargo.
maxerickson 9y ago
The intent is to have as many fixes available as possible at the time knowledge of the flaw becomes widespread.
- philfrasty 9y ago
  Of course. From my understanding of research at public institutions there is a long period of time and steps between finding something interesting and submitting a paper for review. Why not disclose the vulnerability first to concerned parties and then write up a fancy research paper? Why the other way round? Only two explanations I could come up with: Either there must be a very short time frame between identification of the vulnerability and writing of the paper or there was further research needed. Or....I don't know
user5994461 9y ago
July => October. It's 3 month. It's a reasonable delay if you have to alert lots of manufacturer and they need time to roll out critical patches to lots of devices.
- greedo 9y ago
  Full disclosure is reasonable, and the only truly effective methodology. Anything else just allows vendors to delay or ignore.
  - user5994461 9y ago
    It takes time to understand a vulnerability, create a patch and distribute it. Please stop confusing slowness with an intent to delay or ignore.
    - greedo 9y ago
      Vuln disclosure has historically been associated with vendors delaying and ignoring issues for a long long time. That's the whole reason FD came about. There's no confusion on my part.

grabcocque 9y ago

For a vulnerability of this magnitude, it's not unusual for a responsible disclosure to have a five month review window. e.g. Dan Kaminsky's discovery of DNS cache poisoning had a 5 month responsible disclosure embargo.

maxerickson 9y ago

The intent is to have as many fixes available as possible at the time knowledge of the flaw becomes widespread.

philfrasty 9y ago
Of course. From my understanding of research at public institutions there is a long period of time and steps between finding something interesting and submitting a paper for review. Why not disclose the vulnerability first to concerned parties and then write up a fancy research paper? Why the other way round? Only two explanations I could come up with: Either there must be a very short time frame between identification of the vulnerability and writing of the paper or there was further research needed. Or....I don't know

user5994461 9y ago

July => October. It's 3 month. It's a reasonable delay if you have to alert lots of manufacturer and they need time to roll out critical patches to lots of devices.

greedo 9y ago
Full disclosure is reasonable, and the only truly effective methodology. Anything else just allows vendors to delay or ignore.
- user5994461 9y ago
  It takes time to understand a vulnerability, create a patch and distribute it. Please stop confusing slowness with an intent to delay or ignore.
  - greedo 9y ago
    Vuln disclosure has historically been associated with vendors delaying and ignoring issues for a long long time. That's the whole reason FD came about. There's no confusion on my part.