4 ms·

First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question: 1) Never gave a required dat

First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question: 1) Never gave a required date for disclosure. 2) Upon requesting the right to disclose, was told no and he followed suit. 3) Was initially offered a bug bounty of $1300, which was upgraded to $5000. He apparently never bartered on that issue at all. So your entire post was completely irrelevant.

s2g 9y ago
Disclosing unpatched vulnerabilities when the company is asking for an extension of a few weeks to patch is absolutely a dick more and extremely irresponsible.
- bigiain 9y ago
  Seems the researcher's response was something like: "Hey, you know how your front and back door are both unlocked and everybody already knows about it? Well, your bathroom window is open too - so if someone gets past the front gate, across the moat, and into the castle - there's a third unlocked way onto the living quarters." It's not like _this_ bug alone would get anybody RCE - they'd need to chain up some other way in, and if they've done that there are at least two known and unpatched bugs that'd get them the same place as this one already. It's just as easy to argue that pushing for extensions to disclosures that aren't going to decrease security is the dick move here...
- lvh 9y ago
  What is an acceptable amount of time? Why isn’t 90 days the correct number? A comparable bug has been out since Aug2017 and MS hasn’t patched it. Is a year the right number? Does everyone get that extension by asking? How does that help anyone but the people who own the bugs to save face publicly and attackers more time to exploit the bug?
dingo_bat 9y ago
> First of all, Google has no responsibility to give any period of time. Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.
- Buge 9y ago
  Not everyone agrees with you. Some people promote full disclosure. >Full disclosure is the policy of publishing information on vulnerabilities without restriction as early as possible, making the information accessible to the general public without restriction. In general, proponents of full disclosure believe that the benefits of freely available vulnerability research outweigh the risks, whereas opponents prefer to limit the distribution. https://en.wikipedia.org/wiki/Full_disclosure_(computer_security) https://en.wikipedia.org/wiki/Full_disclosure_(computer_secu... https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2... https://news.ycombinator.com/item?id=16579292 https://news.ycombinator.com/item?id=16579292
- lawnchair_larry 9y ago
  Letting vendors leave bugs unfixed is irresponsible. Google didn’t put the bug there. I don’t know why you would think otherwise.
shawnz 9y ago
> First of all, Google has no responsibility to give any period of time. It isn't a "dick move". The motivation of the project is supposedly to protect Google's users. Being firm on disclosure deadlines helps ensure that vendors take the issue seriously. Did they have any indication that Microsoft wasn't taking this seriously? If not, then it sounds like their true motivation is elsewhere.
- lvh 9y ago
  They asked for multiple extensions, couldn’t give a hard deadline on the Redstone release, didn’t disclose why it was hard to patch (“unforeseen code interactions” is basically every patch ever, definitionally!) and a comparable bug has gone unpatched since being publicly disclosed since Aug 2017. Also, looking at the fix... if they have code that relies on being able to lie about which DLL a COM object maps to maybe that’s a problem?! The onus is on MS to show more time is warranted, and so far I’m only seeing evidence to the contrary.
- Dylan16807 9y ago
  > Did they have any indication that Microsoft wasn't taking this seriously? If not, then it sounds like their true motivation is elsewhere. That doesn't follow. The primary reason to be firm is to ensure that vendors take future issues seriously. Belief that the vendor is serious about a single issue removes only a tiny fraction of the motivation to be firm on deadlines.
  - jrockway 9y ago
    There are two possible outcomes with any security issue: 1) The issue is so obscure that nobody else in the world will ever discover it, so not disclosing it to anyone but the vendor is the right choice. 2) The issue has been discovered by someone with malicious intent, and every second that you hide the details from the users, they're at risk. You can't know which case applies, which is why policies about disclosure are useful. If a vendor is informed of a security hole, and they immediately fix it, great, users are saved. If a vendor is informed of a security hole, and they do nothing... eventually users will have to mitigate the risk in their own way (which is usually "stop using the flawed product"). A disclosure deadline strikes a balance; in many cases it's pretty likely that no evildoers have independently discovered the flaw, but would be able to exploit it if they knew the details. So giving the vendor a bit of time to fix the issue is the best solution. But given infinite time, all bugs will be discovered and exploited, so the longer you wait to fix or mitigate, the more risk you take on. Therefore, I think Google's policy strikes a very reasonable balance between protecting through patching and protecting by telling users to use something else. With that in mind, I have no real qualms with people that disclose flaws immediately (letting users be aware of their risk), or vendors that fix an obscure bug that's not being exploited slowly. In the end, if users want to be free from all risk, they should be finding and mitigating these issues themselves... anything you get for free out of someone else's goodwill is a benefit.
emiliobumachar 9y ago
Bartering on reward money before disclosure can easily look like -or be- blackmail.
- jhall1468 9y ago
  Not true. Bartering in this sense meaning suggesting that the reward is at a level consistent with a non-critical bug while this is. Not "Pay me more or I'll release it".

s2g 9y ago

Disclosing unpatched vulnerabilities when the company is asking for an extension of a few weeks to patch is absolutely a dick more and extremely irresponsible.

bigiain 9y ago
Seems the researcher's response was something like: "Hey, you know how your front and back door are both unlocked and everybody already knows about it? Well, your bathroom window is open too - so if someone gets past the front gate, across the moat, and into the castle - there's a third unlocked way onto the living quarters." It's not like _this_ bug alone would get anybody RCE - they'd need to chain up some other way in, and if they've done that there are at least two known and unpatched bugs that'd get them the same place as this one already. It's just as easy to argue that pushing for extensions to disclosures that aren't going to decrease security is the dick move here...
lvh 9y ago
What is an acceptable amount of time? Why isn’t 90 days the correct number? A comparable bug has been out since Aug2017 and MS hasn’t patched it. Is a year the right number? Does everyone get that extension by asking? How does that help anyone but the people who own the bugs to save face publicly and attackers more time to exploit the bug?

dingo_bat 9y ago

> First of all, Google has no responsibility to give any period of time. Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.

Buge 9y ago
Not everyone agrees with you. Some people promote full disclosure. >Full disclosure is the policy of publishing information on vulnerabilities without restriction as early as possible, making the information accessible to the general public without restriction. In general, proponents of full disclosure believe that the benefits of freely available vulnerability research outweigh the risks, whereas opponents prefer to limit the distribution. https://en.wikipedia.org/wiki/Full_disclosure_(computer_security) https://en.wikipedia.org/wiki/Full_disclosure_(computer_secu... https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2... https://news.ycombinator.com/item?id=16579292 https://news.ycombinator.com/item?id=16579292
lawnchair_larry 9y ago
Letting vendors leave bugs unfixed is irresponsible. Google didn’t put the bug there. I don’t know why you would think otherwise.

shawnz 9y ago

> First of all, Google has no responsibility to give any period of time. It isn't a "dick move". The motivation of the project is supposedly to protect Google's users. Being firm on disclosure deadlines helps ensure that vendors take the issue seriously. Did they have any indication that Microsoft wasn't taking this seriously? If not, then it sounds like their true motivation is elsewhere.

lvh 9y ago
They asked for multiple extensions, couldn’t give a hard deadline on the Redstone release, didn’t disclose why it was hard to patch (“unforeseen code interactions” is basically every patch ever, definitionally!) and a comparable bug has gone unpatched since being publicly disclosed since Aug 2017. Also, looking at the fix... if they have code that relies on being able to lie about which DLL a COM object maps to maybe that’s a problem?! The onus is on MS to show more time is warranted, and so far I’m only seeing evidence to the contrary.
Dylan16807 9y ago
> Did they have any indication that Microsoft wasn't taking this seriously? If not, then it sounds like their true motivation is elsewhere. That doesn't follow. The primary reason to be firm is to ensure that vendors take future issues seriously. Belief that the vendor is serious about a single issue removes only a tiny fraction of the motivation to be firm on deadlines.
- jrockway 9y ago
  There are two possible outcomes with any security issue: 1) The issue is so obscure that nobody else in the world will ever discover it, so not disclosing it to anyone but the vendor is the right choice. 2) The issue has been discovered by someone with malicious intent, and every second that you hide the details from the users, they're at risk. You can't know which case applies, which is why policies about disclosure are useful. If a vendor is informed of a security hole, and they immediately fix it, great, users are saved. If a vendor is informed of a security hole, and they do nothing... eventually users will have to mitigate the risk in their own way (which is usually "stop using the flawed product"). A disclosure deadline strikes a balance; in many cases it's pretty likely that no evildoers have independently discovered the flaw, but would be able to exploit it if they knew the details. So giving the vendor a bit of time to fix the issue is the best solution. But given infinite time, all bugs will be discovered and exploited, so the longer you wait to fix or mitigate, the more risk you take on. Therefore, I think Google's policy strikes a very reasonable balance between protecting through patching and protecting by telling users to use something else. With that in mind, I have no real qualms with people that disclose flaws immediately (letting users be aware of their risk), or vendors that fix an obscure bug that's not being exploited slowly. In the end, if users want to be free from all risk, they should be finding and mitigating these issues themselves... anything you get for free out of someone else's goodwill is a benefit.

emiliobumachar 9y ago

Bartering on reward money before disclosure can easily look like -or be- blackmail.

jhall1468 9y ago
Not true. Bartering in this sense meaning suggesting that the reward is at a level consistent with a non-critical bug while this is. Not "Pay me more or I'll release it".