5 ms·

No, but they prevent everybody with ill-intent from exploiting the issue en-masse

• jstanley 9y ago
  No they don't. They prevent everybody with ill intent who doesn't already know about it from finding out about it from the guys without ill intent. That's all.
  • avh02 9y ago
    would you say it prevents the small fry from having a big impact? edit: I think the mirai botnet(s) had some sort of power struggle? avoiding propagating knowledge about it prevents it from being easily exploited by more actors.
  • brazzledazzle 9y ago
    The reality is that there's a group you're excluding from consideration and I don't think it's unreasonable to conclude that embargoes keeps every random "hacker" from taking advantage of it in a packaged form. Being vulnerable to the minority population that can and would take advantage of it vs. anyone that would is a valid consideration and shouldn't be dismissed so casually.
• saas_co_de 9y ago
  Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. Prior to disclosure there will always be the possibility that some users are being exploited without their knowledge. Therefore disclosure always improves the situation by giving those who could have been exploited without their knowledge the choice to take mitigation steps. All of the "responsible disclosure" nonsense is just PR by companies who want to avoid the most obvious mitigation, which is for customers to stop using their products.
  • yeukhon 9y ago
    > Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. And what are those mitigation steps?
    • saas_co_de 9y ago
      Depends on the exploit, but all exploits can be mitigated by stopping your use of the exploited product. That is what companies don't want to happen so they would prefer to sacrifice their users' security and wait until they have a fix before the exploit is disclosed.
      • brazzledazzle 9y ago
        In this specific scenario what's the mitigation for cloud customers? Or even cloud providers? A customer can't migrate all of their infrastructure before a packaged exploit can be distributed. A provider can't dedicate hardware for every single customer. Let's be realistic here.
        • saas_co_de 9y ago
          Get off the cloud. Which is exactly why the companies involved would want to keep it secret. Not everyone is all in on cloud infrastructure. What about people who are right now deciding whether or not to move critical data to the cloud? Should their security be compromised by hiding the truth about a known exploit in order to "protect" people less concerned about security who already put their data at risk?
          • yeukhon 9y ago
            How is Netflix going to move off the cloud overnight? If this vulnerability applies regardless of where it is, what is the mitigation then? Move your machine to where? Your suggestion is not practical and you know it. The right mitigation is one that actually will fix the vulnerability. No one shut down machines and migrated everything to another distro because Debian had a bug in generating private key a decade ago even if the bug was zero-day.
• empath75 9y ago
  If this guy can figure this out, anybody with the means and motivation to write such an exploit is already working on t.
  • saas_co_de 9y ago
    Exactly. This is just some random nerd. There are people all over the world whose full time job it is to track open source projects to develop exploits.
    • avh02 9y ago
      and when script kiddies get wind that there is something potentially disastrous in the open, it can be exploited 10 times harder, that's all I'm saying. I understand (and agree) that the system admins/owners should also be able to mitigate through knowledge, but it's a dilemma that I think is better resolved by the other solution (in this case it's apparently a complex issue, but history has shown that there are surprisingly easy to exploit bugs/issues (see heartbleed, shellshock (which was apparently very quickly exploited.))
      • saas_co_de 9y ago
        No "script kiddies" can write exploit code for something on this level. This guy is not releasing an exploit implementation, he is just pointing to the existence of a potential exploit that has a patch in development. He can't even figure out exactly what it is. The only people who would be able to code this exploit would be the ones who already figured it out before this guy.
  • slackingoff2017 9y ago
    All of the serious hackers with resources have a paid mole involved in the embargo discussion mailing list. The most dangerous people already know. Embargo is simply a way to make sure the huge, rich cloud providers don't have their reputation tarnished at the expense of everyone else. "Stay with bigco, we fix things before everyone finds about it"