3 ms·

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's h

by rapind 8y ago

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable. So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything. How about free market instead? If you run a multi-billion dollar company that can be hurt by issues like this, then it's on you to make it more profitable to disclose issues privately. If you can't or refuse to do that, then you're exposing your company and your customers to risk. Enough with the shunning and the "responsibility" of individuals which expose bugs.

_bxg1 8y ago
This is the most idiotic comment I've ever read on hacker news. "The free market"? What? What does that have to do with anything? Vendors are extremely incentivized to fix bugs and thereby maintain user trust. Google regularly pays out generous bounties for bugs that are reported properly. There are the odd cases where a bug is reported and the company denies it, sits on their hands or threatens the reporter. Those should be made public. But the author makes no mention of that having happened here, and Google is in fact the last company I would expect to behave that way.
- dejanseo 8y ago
  Google? When I brought a serious issue up in 2012 https://dejanseo.com.au/hijack/ https://dejanseo.com.au/hijack/ Google never fixed it: In summary, I can take any of your (or anyone else's content) pass more pagerank to it than the original page and then I become the original page. Not only that but all your inbound links now count towards my site and I can see your links in Search Console of my domain. This is something link graph theory refers to as "link inversion" and is very harmful to smaller publishers.
  - _bxg1 8y ago
    I can't speak to that particular exploit, but no matter what you always go to the vendor privately first. Period. If they are uncooperative you can then go public. Not before.
    - rapind 8y ago
      I'm not sure how to respond to your comment (for the record I didn't downvote you). The free market point was obvious to me, but I'll elaborate. When he chose to expose this bug, either he wasn't aware of an alternative (so called responsible private disclosure) or that alternative just wasn't appealing enough. Since we're dealing with a company that generates income (indirectly) through the product, they risk financial consequences from this sort of exposure. It follows that doing more to incentivize and generate awareness of their disclosure policy would reduce their risk which would have a financial impact. It's up to them to decide how much to money / effort / resources to spend on reducing that risk. My stance is that public shunning doesn't solve the problem of releasing buggy software. I'm actually a Google fanboy, but (to me) they could do better. Instead we get "The site is completely removed from their index without any notification." Maybe we need to elevate browser security to the level of Space Shuttle safety? Obviously that costs more and takes longer, slowing innovation, but IMO the market should determine that. TLDR; The idea that the individual is responsible for exposing a companies bugs is completely absurd to me. I'll respect you having a different opinion on it.
- sctb 8y ago
  Please don't do this. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html (see "idiotic")
refoundglory 8y ago
So you're saying that small companies should just accept that any bugs found will be sold to black hats?
EGreg 8y ago
I sympathize with THIS position. It’s the same blame shifting crap when “identity theft” becomes your fault, even though any cashier or clerk can “steal your identity”. What this marketing spin does is give cover to those who design badly secured systems. http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E Also similar is the “jaywalking” idea, made by car manufacturers to make the default right of way to cars! http://amp.charlotteobserver.com/opinion/op-ed/article65032222.html http://amp.charlotteobserver.com/opinion/op-ed/article650322...

by rapind 8y ago

_bxg1 8y ago

This is the most idiotic comment I've ever read on hacker news. "The free market"? What? What does that have to do with anything? Vendors are extremely incentivized to fix bugs and thereby maintain user trust. Google regularly pays out generous bounties for bugs that are reported properly. There are the odd cases where a bug is reported and the company denies it, sits on their hands or threatens the reporter. Those should be made public. But the author makes no mention of that having happened here, and Google is in fact the last company I would expect to behave that way.

dejanseo 8y ago
Google? When I brought a serious issue up in 2012 https://dejanseo.com.au/hijack/ https://dejanseo.com.au/hijack/ Google never fixed it: In summary, I can take any of your (or anyone else's content) pass more pagerank to it than the original page and then I become the original page. Not only that but all your inbound links now count towards my site and I can see your links in Search Console of my domain. This is something link graph theory refers to as "link inversion" and is very harmful to smaller publishers.
- _bxg1 8y ago
  I can't speak to that particular exploit, but no matter what you always go to the vendor privately first. Period. If they are uncooperative you can then go public. Not before.
  - rapind 8y ago
    I'm not sure how to respond to your comment (for the record I didn't downvote you). The free market point was obvious to me, but I'll elaborate. When he chose to expose this bug, either he wasn't aware of an alternative (so called responsible private disclosure) or that alternative just wasn't appealing enough. Since we're dealing with a company that generates income (indirectly) through the product, they risk financial consequences from this sort of exposure. It follows that doing more to incentivize and generate awareness of their disclosure policy would reduce their risk which would have a financial impact. It's up to them to decide how much to money / effort / resources to spend on reducing that risk. My stance is that public shunning doesn't solve the problem of releasing buggy software. I'm actually a Google fanboy, but (to me) they could do better. Instead we get "The site is completely removed from their index without any notification." Maybe we need to elevate browser security to the level of Space Shuttle safety? Obviously that costs more and takes longer, slowing innovation, but IMO the market should determine that. TLDR; The idea that the individual is responsible for exposing a companies bugs is completely absurd to me. I'll respect you having a different opinion on it.
sctb 8y ago
Please don't do this. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html (see "idiotic")

refoundglory 8y ago

So you're saying that small companies should just accept that any bugs found will be sold to black hats?

EGreg 8y ago

I sympathize with THIS position. It’s the same blame shifting crap when “identity theft” becomes your fault, even though any cashier or clerk can “steal your identity”. What this marketing spin does is give cover to those who design badly secured systems. http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E Also similar is the “jaywalking” idea, made by car manufacturers to make the default right of way to cars! http://amp.charlotteobserver.com/opinion/op-ed/article65032222.html http://amp.charlotteobserver.com/opinion/op-ed/article650322...