4 ms·

> Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. And what are those mitigation steps?

saas_co_de 9y ago
Depends on the exploit, but all exploits can be mitigated by stopping your use of the exploited product. That is what companies don't want to happen so they would prefer to sacrifice their users' security and wait until they have a fix before the exploit is disclosed.
- brazzledazzle 9y ago
  In this specific scenario what's the mitigation for cloud customers? Or even cloud providers? A customer can't migrate all of their infrastructure before a packaged exploit can be distributed. A provider can't dedicate hardware for every single customer. Let's be realistic here.
  - saas_co_de 9y ago
    Get off the cloud. Which is exactly why the companies involved would want to keep it secret. Not everyone is all in on cloud infrastructure. What about people who are right now deciding whether or not to move critical data to the cloud? Should their security be compromised by hiding the truth about a known exploit in order to "protect" people less concerned about security who already put their data at risk?
    - yeukhon 9y ago
      How is Netflix going to move off the cloud overnight? If this vulnerability applies regardless of where it is, what is the mitigation then? Move your machine to where? Your suggestion is not practical and you know it. The right mitigation is one that actually will fix the vulnerability. No one shut down machines and migrated everything to another distro because Debian had a bug in generating private key a decade ago even if the bug was zero-day.
  - lionradio 9y ago
    One might migrate some super important instances to bear metal or cloud hardware under full control. If this is an embargo against a bug that could make VMs on the same hardware attackable this should be public.
  - deleted 9y ago
    [deleted]
  - myself248 9y ago
    This is the classic case of the frog being boiled. Or the pig getting lazy... At every step along the way, there's been a choice of "Well, we could own the hardware and incur overhead costs, or we could trust someone else and pay our share of lower overhead. It'll mean giving up some control, but it'll save us a few bucks." Or maybe it goes like "Well, we could develop with practices that result in more robust code, but we'd be slower to market." There's definitely a sidetrack of "If we crank up the clock too much, all sorts of things get wibbly and we can no longer guarantee that the outputs match the inputs, but we don't actually have ways of doing it correctly at these speeds. The press will slam us if we don't keep pace with Moore's law, how could we launch a product with only marginal speed gains?" And pretty often I think it sounds like "The ops staff says they're overworked and we need to add people or we risk an incident, but Salesman Bob says we can actually fire most of them if we put our stuff in BobCloud." At every step along the way, someone made a conscious choice to do the insecure thing. The folks with their eye on security were dismissed as naysayers, and profit was paramount. And because these practices became so common, they became enshrined in market norms and expected overhead costs. > A provider can't dedicate hardware for every single customer. A provider absolutely could dedicate hardware for every single customer, that's literally how every provider operated before virtualization. It just wasn't as profitable as virtualization. The story of the Three Little Pigs was supposed to teach about the importance of robust infrastructure. Nobody should be surprised when the wolf shows up. And every pig had the choice to build with sticks or bricks, it would just take more work or cost more. And I see your message as saying "Are you serious? Build with something other than straw?! But we already own so much straw! All the pigs have straw houses, won't someone think of the pigs?" Meanwhile the bankrupt brick vendor's assets have been auctioned off, and the wolves are salivating.
    - idonotknowwhy 9y ago
      The three little pigs taught me "Don't bother putting in the hard work; because when the shit hits the fan, someone else will happily bail you out".

saas_co_de 9y ago

Depends on the exploit, but all exploits can be mitigated by stopping your use of the exploited product. That is what companies don't want to happen so they would prefer to sacrifice their users' security and wait until they have a fix before the exploit is disclosed.

brazzledazzle 9y ago
In this specific scenario what's the mitigation for cloud customers? Or even cloud providers? A customer can't migrate all of their infrastructure before a packaged exploit can be distributed. A provider can't dedicate hardware for every single customer. Let's be realistic here.
- saas_co_de 9y ago
  Get off the cloud. Which is exactly why the companies involved would want to keep it secret. Not everyone is all in on cloud infrastructure. What about people who are right now deciding whether or not to move critical data to the cloud? Should their security be compromised by hiding the truth about a known exploit in order to "protect" people less concerned about security who already put their data at risk?
  - yeukhon 9y ago
    How is Netflix going to move off the cloud overnight? If this vulnerability applies regardless of where it is, what is the mitigation then? Move your machine to where? Your suggestion is not practical and you know it. The right mitigation is one that actually will fix the vulnerability. No one shut down machines and migrated everything to another distro because Debian had a bug in generating private key a decade ago even if the bug was zero-day.
- lionradio 9y ago
  One might migrate some super important instances to bear metal or cloud hardware under full control. If this is an embargo against a bug that could make VMs on the same hardware attackable this should be public.
- deleted 9y ago
  [deleted]
- myself248 9y ago
  This is the classic case of the frog being boiled. Or the pig getting lazy... At every step along the way, there's been a choice of "Well, we could own the hardware and incur overhead costs, or we could trust someone else and pay our share of lower overhead. It'll mean giving up some control, but it'll save us a few bucks." Or maybe it goes like "Well, we could develop with practices that result in more robust code, but we'd be slower to market." There's definitely a sidetrack of "If we crank up the clock too much, all sorts of things get wibbly and we can no longer guarantee that the outputs match the inputs, but we don't actually have ways of doing it correctly at these speeds. The press will slam us if we don't keep pace with Moore's law, how could we launch a product with only marginal speed gains?" And pretty often I think it sounds like "The ops staff says they're overworked and we need to add people or we risk an incident, but Salesman Bob says we can actually fire most of them if we put our stuff in BobCloud." At every step along the way, someone made a conscious choice to do the insecure thing. The folks with their eye on security were dismissed as naysayers, and profit was paramount. And because these practices became so common, they became enshrined in market norms and expected overhead costs. > A provider can't dedicate hardware for every single customer. A provider absolutely could dedicate hardware for every single customer, that's literally how every provider operated before virtualization. It just wasn't as profitable as virtualization. The story of the Three Little Pigs was supposed to teach about the importance of robust infrastructure. Nobody should be surprised when the wolf shows up. And every pig had the choice to build with sticks or bricks, it would just take more work or cost more. And I see your message as saying "Are you serious? Build with something other than straw?! But we already own so much straw! All the pigs have straw houses, won't someone think of the pigs?" Meanwhile the bankrupt brick vendor's assets have been auctioned off, and the wolves are salivating.
  - idonotknowwhy 9y ago
    The three little pigs taught me "Don't bother putting in the hard work; because when the shit hits the fan, someone else will happily bail you out".