5 ms·

I don't like the term you made up. But fine, I think this is "Irresponsible Disclosure." Is that better? Did anything change? Vendors and non-vendors alike are

by tensor 9y ago

I don't like the term you made up. But fine, I think this is "Irresponsible Disclosure." Is that better? Did anything change? Vendors and non-vendors alike are all responsible for good security, and that includes working together to make this happen. If you are working against vendors because of some preconceived notion that they are "evil," that's not a good thing. If it turns out that the author did submit to the vendor and worked together to minimize damage then I'll retract my statement. Until then I think it's irresponsible, not just "uncoordinated".

tajen 9y ago
It’s not « preconceived »: Vendors have very low bounties, not even covering the time spent on 1 issue (none for macOS I think) and the reason researchers are working with them is more the drawback of working in black hat than the reward of white hats.
dpwm 9y ago
The problem is that allowing the vendor to define what is responsible, which seems these days to be expanding into giving them unlimited time to fix it, is to allow them to take unlimited time to fix it. Cooperation or even coordination takes willingness from both parties. Let's look at the actual page apple has on reporting security issues [0] "When we receive your email, we send an automatic email as acknowledgment. If you do not get this email, please check the email address and send again. We will respond with additional emails if we need further information to investigate a security issue." Something seems a bit off here. I would have expected a human to get back within a few working days for a serious security problem. That might be in the auto response email, but I wouldn't be surprised if it wasn't. "For the protection of our customers, Apple generally does not disclose, discuss, or confirm security issues until a full investigation is complete and any necessary patches or releases are available." Does this extend to the security researcher that reports the vulnerability? If so, that's probably why there was no coordination. [0] https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220 Edit: removed spelling mistake mistake.
- an_account 9y ago
  As a Mac user, I feel it’s irresponsible. I don’t want zero days published before Apple has a chance to fix. I also think that the vendor has a responsibility to fix the exploit quickly, and if not the researcher should publish and shame the vendor.
  - deleted 9y ago
    [deleted]
  - mcny 9y ago
    The author has commented above. It seems Apple was aware of this issue before the author published it. I wouldn't put any blame on the author at all.
  - Digital-Citizen 9y ago
    Is 3 years considered quickly enough? How about 3 years for a remotely-exploitable problem? According to <a href="http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html">The http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT... Telegraph</a>, "Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month [Nov 2011], a delay of more than three years.". It seems to me that nobody but Apple has a responsibility to its users. The public at large certainly doesn't owe Apple (or any other software proprietor) specific performance regardless of whether they report what they've found publicly or when. Apple is also not being nice to its users by denying them software freedom: most of MacOS is proprietary and the aforementioned bug concerned iTunes, a proprietary media player. So no matter how technically savvy and willing the user is, they're not allowed to diagnose and fix the problem, prepare a fixed copy of the changed files, and help their community by sharing copies of the improved code. "Responsible disclosure" is indeed propaganda that benefits the proprietor in a clumsy attempt to divert blame for a product people paid for with their software freedom as well as their money.
  - jodrellblank 9y ago
    I don’t want zero days published before Apple has a chance to fix. Because you think you are safe until publication? What kind of "if I don't know about it, it isn't happening" worldview is that?
jjoonathan 9y ago
> and that includes working together to make this happen It also includes disclosure if the vendor drags their feet and does nothing, which is a very common response. I have no preconceived notion that vendors are "evil," but I sure as hell have a preconceived notion that they're as lazy as they think they can get away with.
JohnTHaller 9y ago
I think "irresponsible disclosure" would involve disclosing it to black hats for money.
- djrogers 9y ago
  Well, it has been disclosed to black hats - just not for money. To end users the result is the same; black hats have an unpatched 0day to play with, and we have no mitigations to deploy.
  - zbentley 9y ago
    Well, we do have mitigations. They're not good ones, but they're mitigations: - Be more paranoid about allowing r/w direct access to your computer. - Be prepared to power off or otherwise halt your machine if (on 10.13.12) you see unexpected logouts or similar. - Safeguard your data and/or consider moving it off of the machine or not using it in some situations. None of those are great things to rely on or to have to do. A real working patch or detection mechanism would definitely be better. But that's not the same as "no mitigations" whatsoever.
  - danieldk 9y ago
    The end result is not the same. You know about the bug as well, whereas if the bug + exploit was sold to black hats, they can use it without your awareness. This would be a less serious problem if vendors pushed out fixes faster.
    - floatingatoll 9y ago
      Note that 99.99% or more of end users remain unaware of this bug, regardless of this HN post about it.
riquito 9y ago
Why a consumer should be left in the dark while malicious attackers may discover (or have discovered) the same hack? The consumer should know right away that the system is not secure and take action (like not using it any more until a patch is released). That would be responsible. If you knew something is dangerous would you let your family/friends in the dark just to give the Company the time to fix it?

by tensor 9y ago

tajen 9y ago

It’s not « preconceived »: Vendors have very low bounties, not even covering the time spent on 1 issue (none for macOS I think) and the reason researchers are working with them is more the drawback of working in black hat than the reward of white hats.

dpwm 9y ago

The problem is that allowing the vendor to define what is responsible, which seems these days to be expanding into giving them unlimited time to fix it, is to allow them to take unlimited time to fix it. Cooperation or even coordination takes willingness from both parties. Let's look at the actual page apple has on reporting security issues [0] "When we receive your email, we send an automatic email as acknowledgment. If you do not get this email, please check the email address and send again. We will respond with additional emails if we need further information to investigate a security issue." Something seems a bit off here. I would have expected a human to get back within a few working days for a serious security problem. That might be in the auto response email, but I wouldn't be surprised if it wasn't. "For the protection of our customers, Apple generally does not disclose, discuss, or confirm security issues until a full investigation is complete and any necessary patches or releases are available." Does this extend to the security researcher that reports the vulnerability? If so, that's probably why there was no coordination. [0] https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220 Edit: removed spelling mistake mistake.

an_account 9y ago
As a Mac user, I feel it’s irresponsible. I don’t want zero days published before Apple has a chance to fix. I also think that the vendor has a responsibility to fix the exploit quickly, and if not the researcher should publish and shame the vendor.
- deleted 9y ago
  [deleted]
- mcny 9y ago
  The author has commented above. It seems Apple was aware of this issue before the author published it. I wouldn't put any blame on the author at all.
- Digital-Citizen 9y ago
  Is 3 years considered quickly enough? How about 3 years for a remotely-exploitable problem? According to <a href="http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html">The http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT... Telegraph</a>, "Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month [Nov 2011], a delay of more than three years.". It seems to me that nobody but Apple has a responsibility to its users. The public at large certainly doesn't owe Apple (or any other software proprietor) specific performance regardless of whether they report what they've found publicly or when. Apple is also not being nice to its users by denying them software freedom: most of MacOS is proprietary and the aforementioned bug concerned iTunes, a proprietary media player. So no matter how technically savvy and willing the user is, they're not allowed to diagnose and fix the problem, prepare a fixed copy of the changed files, and help their community by sharing copies of the improved code. "Responsible disclosure" is indeed propaganda that benefits the proprietor in a clumsy attempt to divert blame for a product people paid for with their software freedom as well as their money.
- jodrellblank 9y ago
  I don’t want zero days published before Apple has a chance to fix. Because you think you are safe until publication? What kind of "if I don't know about it, it isn't happening" worldview is that?

jjoonathan 9y ago

> and that includes working together to make this happen It also includes disclosure if the vendor drags their feet and does nothing, which is a very common response. I have no preconceived notion that vendors are "evil," but I sure as hell have a preconceived notion that they're as lazy as they think they can get away with.

JohnTHaller 9y ago

I think "irresponsible disclosure" would involve disclosing it to black hats for money.

djrogers 9y ago
Well, it has been disclosed to black hats - just not for money. To end users the result is the same; black hats have an unpatched 0day to play with, and we have no mitigations to deploy.
- zbentley 9y ago
  Well, we do have mitigations. They're not good ones, but they're mitigations: - Be more paranoid about allowing r/w direct access to your computer. - Be prepared to power off or otherwise halt your machine if (on 10.13.12) you see unexpected logouts or similar. - Safeguard your data and/or consider moving it off of the machine or not using it in some situations. None of those are great things to rely on or to have to do. A real working patch or detection mechanism would definitely be better. But that's not the same as "no mitigations" whatsoever.
- danieldk 9y ago
  The end result is not the same. You know about the bug as well, whereas if the bug + exploit was sold to black hats, they can use it without your awareness. This would be a less serious problem if vendors pushed out fixes faster.
  - floatingatoll 9y ago
    Note that 99.99% or more of end users remain unaware of this bug, regardless of this HN post about it.

riquito 9y ago

Why a consumer should be left in the dark while malicious attackers may discover (or have discovered) the same hack? The consumer should know right away that the system is not secure and take action (like not using it any more until a patch is released). That would be responsible. If you knew something is dangerous would you let your family/friends in the dark just to give the Company the time to fix it?