6 ms·
The problem is that allowing the vendor to define what is responsible, which seems these days to be expanding into giving them unlimited time to fix it, is to a
by dpwm 9y ago
The problem is that allowing the vendor to define what is responsible, which seems these days to be expanding into giving them unlimited time to fix it, is to allow them to take unlimited time to fix it.
Cooperation or even coordination takes willingness from both parties. Let's look at the actual page apple has on reporting security issues [0]
"When we receive your email, we send an automatic email as acknowledgment. If you do not get this email, please check the email address and send again. We will respond with additional emails if we need further information to investigate a security issue."
Something seems a bit off here. I would have expected a human to get back within a few working days for a serious security problem. That might be in the auto response email, but I wouldn't be surprised if it wasn't.
"For the protection of our customers, Apple generally does not disclose, discuss, or confirm security issues until a full investigation is complete and any necessary patches or releases are available."
Does this extend to the security researcher that reports the vulnerability? If so, that's probably why there was no coordination.
[0] https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220
Edit: removed spelling mistake mistake.
- an_account 9y agoAs a Mac user, I feel it’s irresponsible. I don’t want zero days published before Apple has a chance to fix. I also think that the vendor has a responsibility to fix the exploit quickly, and if not the researcher should publish and shame the vendor.
- deleted 9y ago[deleted]
- mcny 9y agoThe author has commented above. It seems Apple was aware of this issue before the author published it. I wouldn't put any blame on the author at all.
- Digital-Citizen 9y agoIs 3 years considered quickly enough? How about 3 years for a remotely-exploitable problem? According to <a href="http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html">The http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT... Telegraph</a>, "Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month [Nov 2011], a delay of more than three years.". It seems to me that nobody but Apple has a responsibility to its users. The public at large certainly doesn't owe Apple (or any other software proprietor) specific performance regardless of whether they report what they've found publicly or when. Apple is also not being nice to its users by denying them software freedom: most of MacOS is proprietary and the aforementioned bug concerned iTunes, a proprietary media player. So no matter how technically savvy and willing the user is, they're not allowed to diagnose and fix the problem, prepare a fixed copy of the changed files, and help their community by sharing copies of the improved code. "Responsible disclosure" is indeed propaganda that benefits the proprietor in a clumsy attempt to divert blame for a product people paid for with their software freedom as well as their money.
- jodrellblank 9y agoI don’t want zero days published before Apple has a chance to fix. Because you think you are safe until publication? What kind of "if I don't know about it, it isn't happening" worldview is that?
- stordoff 9y ago> in addition to the spelling of acknowledgement "acknowledgment" is the English US form: https://en.oxforddictionaries.com/definition/acknowledgement https://en.oxforddictionaries.com/definition/acknowledgement
- dpwm 9y agoThanks. I thought I was aware of most differences, but clearly there is always more to learn with respect to the differences between the two localizations.
- kbenson 9y agoThis made me think of judgement/judgment, so I looked it up there too. It's apparently mixed enough everywhere that there's not a localization. It always makes me pause to think what form is correct whenever I have to write it.
- eridius 9y agoSince when did the term "responsible disclosure" mean allowing the vendor unlimited time to fix it?
- newfoundglory 9y agoIf it's not unlimited, what's the limit? Apparently a month isn't long enough.
- eridius 9y agoThey admitted they never contacted Apple product security, which means they never notified Apple to begin with. That month you see at the top of the writeup appears to be how long they waited for ZDI before deciding to publish, not how long they waited for Apple to fix it.
- lawnchair_larry 9y agoSo what? They owe Apple nothing. They owe you nothing. Unless you are taking requests from random HN commenters for software that you would like to build them for free, I suggest you rethink your suggestion for highly skilled researchers to donate charity labor to the largest corporation in the world.
- eridius 9y agoThis has nothing to do with owing Apple anything and instead has to do with not intentionally compromising the security of millions of innocent people around the world. And before you interpret this to mean never disclosing publicly, that’s not what I’m saying. But no matter what your opinion is on the best way to handle disclosure, releasing a 0day without any attempt whatsoever to notify the vendor is highly irresponsible and immoral.
- lawnchair_larry 9y agoNo, it isn't.
- floatingatoll 9y agoYou imply by framing without explicitly stating that "coordinated disclosure" is "unlimited time", but that's not the time frame under discussion. I consider 24 hours notice bare minimum responsible disclosure, and 1 business day in the operating timezone of the company as an polite courtesy to the human beings who have to respond to uncoordinated security disclosures with emergency builds of their product. What do you consider the bare minimum notice sufficient to respect the human beings who use the products we find vulns in? One business day? One hour? Zero seconds? (Siguza, I'd also love to hear from you on this question, if you're willing to share. I know Apple said they don't need advance notice but if they hadn't, and offered no guidance, what would you have chosen?)
- GordonS 9y ago> I consider 24 hours notice bare minimum responsible disclosure You can't possibly be serious? Have I fallen for some trolling here?!
- floatingatoll 9y agoThat would be technically impossible, since you had no prior participation in this thread. I would have happily answered questions about my choice, but if your only question is “r u trolln” then there really is very little to say. Rabble-rouse all you like, but unless you respond with whatever your personal bare minimum delay is, you risk being perceived as the troll in this exchange.
- GordonS 9y agoGiven... > I consider 24 hours notice bare minimum responsible disclosure ...it seems rather unfair of you to have a go at my reaction. But somewhat incredibly, it appears you are serious. I don't have a bare minimum delay - I think the vulnerability discover should coordinate a 'sensible' and 'fair' disclose with the vendor. What 'sensible' and 'fair' means, really depends - how serious is the vulnerability? How many systems are affected? How quickly can the vendor patch, test and document a fix? How quickly can the fix be distributed? It's a stretch to imagine a scenario where 24 hours is in any way sensible, fair or responsible. I'd be intrigued to know your reasoning.