4 ms·

I think your perspective is a bit narrow. If you consider each individual person, [3] is indeed nonsense. However, the impact of many hacks comes disproportiona

I think your perspective is a bit narrow. If you consider each individual person, [3] is indeed nonsense. However, the impact of many hacks comes disproportionally from high-value targets. Some high-value targets (e.g. key infrastructure, parts of government, major enterprises) have dedicated security teams, and can come up with a pretty decent response if given the appropriate information. Divulging vulnerability information widely, in particular, may or may not be a net benefit to them. (Consider e.g. Linux vendor vulnerability lists.) Other high-value targets (e.g. journalists, human-rights activists, etc.) are utterly outgunned by their adversaries (who can afford to buy or find new vulnerabilities), and can only hope that something causes vendors to consistently write software that's sufficiently-uneconomic to exploit. In the sufficiently-long run, proponents of full disclosure would argue, anything that increases the cost of shipping vulnerable software should help these users. (Disclaimer: absolutely not speaking for my employer here.)

eropple 9y ago
Nobody appointed these security researchers to the authority to which you assign to their actions, though. Burning the immediate user on the off chance that it helps the hypothetical future user is some very weak tea. I agree that some proponents of immediate disclosure would claim that their actions encourage vendors to ship less vulnerable hardware or software. I do not believe that that, in the general case, is why it is being done. And I am certain that that, in this specific case, is not why it was done.
- mlyle 9y ago
  Well, the very idea that there is some timelimit on mitigation before the flaw is disclosed anyways is that "very weak tea". However, overall, I agree with you. Person with exploit needs to compare the probable consequences of disclosing at time N vs. disclosing at time N+1. If it's being exploited in the wild and users can meaningfully self-protect, disclose now! If the vendor will probably have a patch in 2 weeks, there is not widespread exploitation of the vulnerability, and disclosing now will cause widespread exploitation, disclose in 2 weeks. If the vendor seems like they will never issue a patch on their own (because significant time has elapsed), such that at some point in the future there's going to be widespread exploitation and you're only hastening that a bit, go ahead and disclose now.

eropple 9y ago

Nobody appointed these security researchers to the authority to which you assign to their actions, though. Burning the immediate user on the off chance that it helps the hypothetical future user is some very weak tea. I agree that some proponents of immediate disclosure would claim that their actions encourage vendors to ship less vulnerable hardware or software. I do not believe that that, in the general case, is why it is being done. And I am certain that that, in this specific case, is not why it was done.

mlyle 9y ago
Well, the very idea that there is some timelimit on mitigation before the flaw is disclosed anyways is that "very weak tea". However, overall, I agree with you. Person with exploit needs to compare the probable consequences of disclosing at time N vs. disclosing at time N+1. If it's being exploited in the wild and users can meaningfully self-protect, disclose now! If the vendor will probably have a patch in 2 weeks, there is not widespread exploitation of the vulnerability, and disclosing now will cause widespread exploitation, disclose in 2 weeks. If the vendor seems like they will never issue a patch on their own (because significant time has elapsed), such that at some point in the future there's going to be widespread exploitation and you're only hastening that a bit, go ahead and disclose now.