3 ms·

You got everything wrong. If big vendors are unable to patch their proprietary products in an acceptable time, that shouldn't put others at risk. Users shouldn'

You got everything wrong. If big vendors are unable to patch their proprietary products in an acceptable time, that shouldn't put others at risk. Users shouldn't choose their products... Think about it in a different way: What if a vulnerability was discovered in TLS and FOSS implementations patched it, but there is an embargo for supposedly protecting some banking software? What if NSA/CIA/other agencies find out about it (they would know immediately) and use it to target users/activists?

cyphar 9y ago
This is why embargoes have deadlines. To make the necessary trade-off between "patch as soon as you can, potentially jeopardising the safety of users -- even users of non-proprietary projects" and "wait for everyone to be ready before you patch -- which also jeopardises users". The embargo system deals with this by forcing everyone to agree on a date, and if someone patches after that date then too bad. You may disagree that the deadline was so long, and that could be a fair criticism. But pretending as though co-ordination of any kind is somehow bad (and then resorting to emotional arguments and so on) is pretty reckless.
- mimi89999 9y ago
  3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS projects get only notified on the disclosure date. Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors. Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them. The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.
  - user5994461 9y ago
    The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.
    - mimi89999 9y ago
      No as I would know about it by following security news?
      - user5994461 9y ago
        Are you so great that you know all the vulnerabilities all the time since the second of disclosure? Do you seriously expect the other billions of people on the planet to be that great too?
        mimi89999 9y ago
        For most of them the day after, when I get a notification from my RSS app... No. I also don't expect them to choose device based on security. That is very bad as vendors won't care about patching their older devices (look at Android devices, home routers...) and vendors won't care about patching their flagship devices fast as they have the possibility to request very long embargos. Making compromises for those vendors and giving more time for security agencies and other bad actors to silently exploit the vulnerabilities (where FOSS projects would have made patches for users that care) is not the way to go. That philosophy actually makes everybody less safe.
- bitexploder 9y ago
  I have seen and participated in this disclosure debate for 10 years now. I have come to the conclusion that, in the long run, the least harm approach is full disclosure. There isn't any wiggle room. There are no shades of grey. The whole coordinated response movement is misguided. There are some limited circumstances where it can make sense to delay disclosure, such as creating an imminent threat to human life, but generally full and nearly real time disclosure results in safer software sooner for end users without putting them at some unknown, but high risk level.
Fnoord 9y ago
What if [...] is FUD. What if Theo de Raadt works for the FSB? We need to work with the facts. If you don't agree with an embargo and decide to break it, that's on you. But the consequence is that you shouldn't be surprised if next time you're informed later, or not at all. What OpenBSD proponents and developers are doing right now, is damage control. It may work this time, it may work next time, but it won't keep working every time so pick your fights right. It isn't the first debacle OpenBSD has with full disclosure either (hint: OpenSSH). There are also millions upon millions of devices which won't get patched. Given the vulnerability is apparently the most vulnerable on Linux and hence Android, do you think all the smartphones running Android 4.3, 4.4, 5.0, and 6.0 will be patched [1]? [1] https://en.wikipedia.org/wiki/Android_(operating_system)#Platform_usage https://en.wikipedia.org/wiki/Android_(operating_system)#Pla...
- macawfish 9y ago
  No, I don't. And its stupid, because it doesn't have to be that way. But telecoms have complicated the situation with their greedy firmware reinforced planned obsolescence.

cyphar 9y ago

This is why embargoes have deadlines. To make the necessary trade-off between "patch as soon as you can, potentially jeopardising the safety of users -- even users of non-proprietary projects" and "wait for everyone to be ready before you patch -- which also jeopardises users". The embargo system deals with this by forcing everyone to agree on a date, and if someone patches after that date then too bad. You may disagree that the deadline was so long, and that could be a fair criticism. But pretending as though co-ordination of any kind is somehow bad (and then resorting to emotional arguments and so on) is pretty reckless.

mimi89999 9y ago
3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS projects get only notified on the disclosure date. Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors. Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them. The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.
- user5994461 9y ago
  The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.
  - mimi89999 9y ago
    No as I would know about it by following security news?
    - user5994461 9y ago
      Are you so great that you know all the vulnerabilities all the time since the second of disclosure? Do you seriously expect the other billions of people on the planet to be that great too?
      - mimi89999 9y ago
        For most of them the day after, when I get a notification from my RSS app... No. I also don't expect them to choose device based on security. That is very bad as vendors won't care about patching their older devices (look at Android devices, home routers...) and vendors won't care about patching their flagship devices fast as they have the possibility to request very long embargos. Making compromises for those vendors and giving more time for security agencies and other bad actors to silently exploit the vulnerabilities (where FOSS projects would have made patches for users that care) is not the way to go. That philosophy actually makes everybody less safe.
bitexploder 9y ago
I have seen and participated in this disclosure debate for 10 years now. I have come to the conclusion that, in the long run, the least harm approach is full disclosure. There isn't any wiggle room. There are no shades of grey. The whole coordinated response movement is misguided. There are some limited circumstances where it can make sense to delay disclosure, such as creating an imminent threat to human life, but generally full and nearly real time disclosure results in safer software sooner for end users without putting them at some unknown, but high risk level.

Fnoord 9y ago

What if [...] is FUD. What if Theo de Raadt works for the FSB? We need to work with the facts. If you don't agree with an embargo and decide to break it, that's on you. But the consequence is that you shouldn't be surprised if next time you're informed later, or not at all. What OpenBSD proponents and developers are doing right now, is damage control. It may work this time, it may work next time, but it won't keep working every time so pick your fights right. It isn't the first debacle OpenBSD has with full disclosure either (hint: OpenSSH). There are also millions upon millions of devices which won't get patched. Given the vulnerability is apparently the most vulnerable on Linux and hence Android, do you think all the smartphones running Android 4.3, 4.4, 5.0, and 6.0 will be patched [1]? [1] https://en.wikipedia.org/wiki/Android_(operating_system)#Platform_usage https://en.wikipedia.org/wiki/Android_(operating_system)#Pla...

macawfish 9y ago
No, I don't. And its stupid, because it doesn't have to be that way. But telecoms have complicated the situation with their greedy firmware reinforced planned obsolescence.