6 ms·

You're building a strawman (as you were in that announcement thread as well). The fact that they didn't allocate a CVE or agree on an embargo is really the leas

by simias 9y ago

You're building a strawman (as you were in that announcement thread as well). The fact that they didn't allocate a CVE or agree on an embargo is really the least of the issues. It's clear that you personally don't want to do that as a security researcher. That's fine, I tend to agree with you. But that's really not the issue. The real problem is that their reveal was clearly meant to mislead. It's was a direct attack on AMD and probably more specifically AMD's stock. Technical details were hidden in the middle of a mediocre whitepaper, all the descriptions of the flaws appear much more critical than they really are. Meanwhile they took the time to make a fancy website and even a video so it's clearly not because of a lack of time or resources. I don't have any particular problem with them "0-day" the announcement but I do have many problems with this pretty obvious manipulation attempt. Do you genuinely think that CTS-lab acted in good faith here and that the way they handled the disclosure was appropriate? Would you advise other security researchers to do the same thing, to make sure to reveal the vulnerabilities in a way that will cause as much damage as possible, even if it means resorting to good old FUD?

tptacek 9y ago
I genuinely, sincerely don't care how CTS acted. I think attempts to profit off stock swings caused by vulnerabilities are silly and based off a misunderstanding of what really causes stock prices to move. But even if they weren't, I wouldn't care. There are three things you can do with a vulnerability that I have a problem with: 1. You can actively exploit the vulnerability to harm people (or knowingly share it with people who do). 2. You can sell a vulnerability without due diligence to ensure it won't be used to harm others. 3. You can lie about having found a vulnerability. Other than that, have at it.
- wtallis 9y ago
  > I genuinely, sincerely don't care how CTS acted. You've made that quite clear, and it's fine for you to feel that way. But don't go around insulting anyone who thinks that some of those less-technical issues surrounding these vulnerabilities are worth talking about.
  - tptacek 9y ago
    I responded because I was asked, pointedly, in the preceding comment.
- notacoward 9y ago
  So if you make it easier for someone else to develop an exploit, which is then deployed before mitigation can be, that's OK so long as you didn't directly profit from it? I think reasonable people can take a different view. It's all too easy to say "let the chips fall where they may" when you feel none of the consequences. It's even easier when maintaining a general atmosphere of threat is in your own business interest.
  - tptacek 9y ago
    And I think it's awfully easy for people who don't do independent unpaid research, and don't contribute in any way to its being conducted, to have strong opinions about the responsibilities researchers have to them. Let me sum this up: they're not working for you. You don't get to tell them what to do. If AMD wanted to protect their users, they'd quadruple their security verification budget. What do you think that budget is as a percentage of R&D costs at AMD? Take a guess.
    - Erlangolem 9y ago
      You still seem to be (intentionally?) ignoring the difference between permissible, and ethical.
      - tptacek 9y ago
        It is not unethical to discover things on your own and reveal some or all of it to the world. Sorry. What's your guess at AMD's security verification budget as a percentage of R&D? And what do you think it should be?
        Erlangolem 9y ago
        I don’t seriously have to explain the concept of two wrongs not making a right, do I? Hopefully by the same token, you’re not really confused by the notion of waiting a month before making something public, vs. being told to never release it. It’s possible to be disgusted with large companies treating security as an afterthought, and people pushing a release in 24 hours because of their disclosed financial interest in the outcome. Likewise, I can support your argument that independent researchers aren’t beholden to AMD or Intel, etc, while finding your total lack of espoused ethics disturbing.

by simias 9y ago

tptacek 9y ago

I genuinely, sincerely don't care how CTS acted. I think attempts to profit off stock swings caused by vulnerabilities are silly and based off a misunderstanding of what really causes stock prices to move. But even if they weren't, I wouldn't care. There are three things you can do with a vulnerability that I have a problem with: 1. You can actively exploit the vulnerability to harm people (or knowingly share it with people who do). 2. You can sell a vulnerability without due diligence to ensure it won't be used to harm others. 3. You can lie about having found a vulnerability. Other than that, have at it.

wtallis 9y ago
> I genuinely, sincerely don't care how CTS acted. You've made that quite clear, and it's fine for you to feel that way. But don't go around insulting anyone who thinks that some of those less-technical issues surrounding these vulnerabilities are worth talking about.
- tptacek 9y ago
  I responded because I was asked, pointedly, in the preceding comment.
notacoward 9y ago
So if you make it easier for someone else to develop an exploit, which is then deployed before mitigation can be, that's OK so long as you didn't directly profit from it? I think reasonable people can take a different view. It's all too easy to say "let the chips fall where they may" when you feel none of the consequences. It's even easier when maintaining a general atmosphere of threat is in your own business interest.
- tptacek 9y ago
  And I think it's awfully easy for people who don't do independent unpaid research, and don't contribute in any way to its being conducted, to have strong opinions about the responsibilities researchers have to them. Let me sum this up: they're not working for you. You don't get to tell them what to do. If AMD wanted to protect their users, they'd quadruple their security verification budget. What do you think that budget is as a percentage of R&D costs at AMD? Take a guess.
  - Erlangolem 9y ago
    You still seem to be (intentionally?) ignoring the difference between permissible, and ethical.
    - tptacek 9y ago
      It is not unethical to discover things on your own and reveal some or all of it to the world. Sorry. What's your guess at AMD's security verification budget as a percentage of R&D? And what do you think it should be?
      - Erlangolem 9y ago
        I don’t seriously have to explain the concept of two wrongs not making a right, do I? Hopefully by the same token, you’re not really confused by the notion of waiting a month before making something public, vs. being told to never release it. It’s possible to be disgusted with large companies treating security as an afterthought, and people pushing a release in 24 hours because of their disclosed financial interest in the outcome. Likewise, I can support your argument that independent researchers aren’t beholden to AMD or Intel, etc, while finding your total lack of espoused ethics disturbing.