5 ms·

My problem is not the security aspect of it, it’s the economic warfare part of it. CTS was shorting the stock. They were security trolling. Everything has a

My problem is not the security aspect of it, it’s the economic warfare part of it. CTS was shorting the stock. They were security trolling. Everything has a bug right? Find a bug, short a stock. Profit.

dsacco 9y ago
> Everything has a bug right? Find a bug, short a stock. Profit. There are reasonable arguments that encouraging this would reduce vulnerabilities, or at least make them more costly. I’m not sure I would bother raising those arguments as it’s likely to draw in anti-finance ideological ire, but they do exist. Activist short selling is not novel, nor is it even novel for activists to short sell on the weight of security vulnerabilities.
- xtfcxp 9y ago
  One problem is that the security firm is incentivized to hinder any mitigation efforts. Hypothetically, a delayed fix or even a successful attack would help their short position.
kbenson 9y ago
Well, yes, until everything is a bit more secure because companies take it more seriously or the computer industry has learned a valuable lesson, and then everyone has benefited because of that. Either the flaws will get priced into the stock forecasting and cost of doing business in the industry or people won't care (there are strong indications it's the latter for these flaws). It's the exact same for people that do this to alert on regular companies. Markets function efficiently when there is lots of accurate information. These people are exposing new information (either previously unknown or hidden by people with a vested interest), which allows the markets to function more efficiently afterwards (which might mean using better info to choose who not to trust with your data, etc). What they get out of it is the ability to execute on the new information slightly before everyone else. This of course assumes the data is real. If it's not there is no public benefit, so it's just fraud. I was under the impression that at least some of the flaws were very trumped up, so it was a little complicated whether they did something wrong, but if most /all are real and cause make problems, then I guess I don't have much of a problem with what they've done even if I do think they've taken a slightly less safe route for the public in order to maximize money. Like freedom of speech is one of those things that I don't always like how it's used but I recognize the good far outweighs the bad.
- notacoward 9y ago
  > until everything is a bit more secure because companies take it more seriously That logic works for full vs. limited (or no) disclosure, but not for immediate vs. 90-day disclosure. In general, the incentive for a vendor with a reasonable embargo period is the same as without, because the effect on their reputation is the same. The only people differently affected are users, who are left more vulnerable for longer than they would have been. Even if one could argue that vendors deserve shaming for what might have been a simple mistake, users surely deserve better. It's very easy for those who do not suffer the damage from their actions to rationalize their impulsive (or in this case venal) behavior, but that's just another kind of agency problem that people who fling economic jargon around should consider.
  - kbenson 9y ago
    > The only people differently affected are users, who are left more vulnerable for longer than they would have been. The assumption being that nobody else knows about the flaws? We can argue about how likely it is some other people knew about the flaw on a case by case basis, but a blanket statement that assumes that there was no risk while it was unreported is not accurately portraying the situation. > Even if one could argue that vendors deserve shaming for what might have been a simple mistake, users surely deserve better. I'm arguing that the risk that the companies exposed people to prior to the announcement (to a small degree), and the risk people may be exposed to after the announcement (to a large degree) are the incentive for someone doing this to take advantage of a short. Would I personally prefer less public risk through a coordinated exposure? Sure. Am I willing to state that it should be required? I don't think so, since that may greatly reduce the incentive of someone looking to do the investigative legwork. I think that's a net loss for the public, since the risk is still there, it's just reduced (since it's not widely known), but it will exist in that reduced state for a long period (possibly indefinitely). When the choice is between an unknown risk (which can by high) for an indeterminate period or a semi-high risk for a short period (with the ability to mitigate risk as needed, since you know about it), I'll take the latter over the former.
    - 9y ago
pjmlp 9y ago
Actually that is great, I would enjoy a meltdown of industry thanks to those kind of actually. Maybe then the industry could start taking QA, testing, static analysis and formal proofs seriously, instead of being done if there is any budget left, if at all.

dsacco 9y ago

> Everything has a bug right? Find a bug, short a stock. Profit. There are reasonable arguments that encouraging this would reduce vulnerabilities, or at least make them more costly. I’m not sure I would bother raising those arguments as it’s likely to draw in anti-finance ideological ire, but they do exist. Activist short selling is not novel, nor is it even novel for activists to short sell on the weight of security vulnerabilities.

xtfcxp 9y ago
One problem is that the security firm is incentivized to hinder any mitigation efforts. Hypothetically, a delayed fix or even a successful attack would help their short position.

kbenson 9y ago

Well, yes, until everything is a bit more secure because companies take it more seriously or the computer industry has learned a valuable lesson, and then everyone has benefited because of that. Either the flaws will get priced into the stock forecasting and cost of doing business in the industry or people won't care (there are strong indications it's the latter for these flaws). It's the exact same for people that do this to alert on regular companies. Markets function efficiently when there is lots of accurate information. These people are exposing new information (either previously unknown or hidden by people with a vested interest), which allows the markets to function more efficiently afterwards (which might mean using better info to choose who not to trust with your data, etc). What they get out of it is the ability to execute on the new information slightly before everyone else. This of course assumes the data is real. If it's not there is no public benefit, so it's just fraud. I was under the impression that at least some of the flaws were very trumped up, so it was a little complicated whether they did something wrong, but if most /all are real and cause make problems, then I guess I don't have much of a problem with what they've done even if I do think they've taken a slightly less safe route for the public in order to maximize money. Like freedom of speech is one of those things that I don't always like how it's used but I recognize the good far outweighs the bad.

notacoward 9y ago
> until everything is a bit more secure because companies take it more seriously That logic works for full vs. limited (or no) disclosure, but not for immediate vs. 90-day disclosure. In general, the incentive for a vendor with a reasonable embargo period is the same as without, because the effect on their reputation is the same. The only people differently affected are users, who are left more vulnerable for longer than they would have been. Even if one could argue that vendors deserve shaming for what might have been a simple mistake, users surely deserve better. It's very easy for those who do not suffer the damage from their actions to rationalize their impulsive (or in this case venal) behavior, but that's just another kind of agency problem that people who fling economic jargon around should consider.
- kbenson 9y ago
  > The only people differently affected are users, who are left more vulnerable for longer than they would have been. The assumption being that nobody else knows about the flaws? We can argue about how likely it is some other people knew about the flaw on a case by case basis, but a blanket statement that assumes that there was no risk while it was unreported is not accurately portraying the situation. > Even if one could argue that vendors deserve shaming for what might have been a simple mistake, users surely deserve better. I'm arguing that the risk that the companies exposed people to prior to the announcement (to a small degree), and the risk people may be exposed to after the announcement (to a large degree) are the incentive for someone doing this to take advantage of a short. Would I personally prefer less public risk through a coordinated exposure? Sure. Am I willing to state that it should be required? I don't think so, since that may greatly reduce the incentive of someone looking to do the investigative legwork. I think that's a net loss for the public, since the risk is still there, it's just reduced (since it's not widely known), but it will exist in that reduced state for a long period (possibly indefinitely). When the choice is between an unknown risk (which can by high) for an indeterminate period or a semi-high risk for a short period (with the ability to mitigate risk as needed, since you know about it), I'll take the latter over the former.
  - 9y ago

pjmlp 9y ago

Actually that is great, I would enjoy a meltdown of industry thanks to those kind of actually. Maybe then the industry could start taking QA, testing, static analysis and formal proofs seriously, instead of being done if there is any budget left, if at all.