4 ms·

> Docker at first denied a vulnerability existed at all, but later patched it on July 19th. After further discussions, they assigned CVE-2018-15514 on the 18th

> Docker at first denied a vulnerability existed at all, but later patched it on July 19th. After further discussions, they assigned CVE-2018-15514 on the 18th August. It’s frustrating that this is the default reaction. I know why it occurs, at least from a human psychological standpoint, but it’s still frustrating. I’ve reported vulnerabilities without response, only to find them thanklessly fixed later. Without reply. But most of the time, my notifications are ignored. It becomes depressing very quickly.

jlawson 8y ago
Are there possible legal consequences to acknowledging such a report, though? Maybe it's not just psychological, but a CYA move.
- scaryclam 8y ago
  It's unlikely. Many companies handle this sort of thing every day and don't deny the issue, just delay confirmation. It's more likely that someone within Docker decided that they didn't believe the report, but didn't bother to investigate properly before responding.
- Kalium 8y ago
  Generally no, there is minimal liability attached to acknowledging a report. There may be internal political issues and definitely external media ones, though. Nobody wants to be the person who says "We're vulnerable, but I don't care enough to fix it". That's how you get internal political battles. Denial solves that problem. When dealing with external reports, it means ammunition for dealing with third parties. "We are not aware of any such vulnerabilities" becomes a defensible position, as does telling reporters that you dispute the claims of vulnerability. Those buy time to maybe fix something. And, well, there's the CYA psychology too. Nobody wants to confront the idea that they, or their smart and hard-working coworkers, screwed up to the point of creating a significant vulnerability.
kerng 8y ago
Something similar happened to me with Amazon a while back. Found some vulns, and they fixed them but never publicly acknowledged them - because they said "the cloud is always patched", so no need to tell anyone- which I thought was an odd response.
- rocketChat 8y ago
  Same for the RocketChat developers: https://github.com/RocketChat/Rocket.Chat/pull/10793 https://github.com/RocketChat/Rocket.Chat/pull/10793 "We do not disclose security fixes as soon we have them fixed to prevent bad guys to exploit them." "as soon we have" means never. They believe bad guys would not monitor the commits of target products.
  - lysp 8y ago
    Not disclosing in release change logs potentially increase the chance of people being affected. If I see a changelog with XSS fixed I will update a product straight away, if I don't - I might leave it a week or two until I have time.
ctz 8y ago
I had a similar experience a few years back with Google (specifically the Android security team). Eager to get the issue fixed, but not in public disclosure or acknowledgement.
bdcravens 8y ago
Personally I've been turned off by Docker the company on numerous occasions. (Still love docker the project) Are there any inroads to a truly open source implementation of Docker for Mac and Windows? (Though I assume running a Linux VM would suffice?) It seems unfortunate that the default is running a non-open binary.

jlawson 8y ago

Are there possible legal consequences to acknowledging such a report, though? Maybe it's not just psychological, but a CYA move.

scaryclam 8y ago
It's unlikely. Many companies handle this sort of thing every day and don't deny the issue, just delay confirmation. It's more likely that someone within Docker decided that they didn't believe the report, but didn't bother to investigate properly before responding.
Kalium 8y ago
Generally no, there is minimal liability attached to acknowledging a report. There may be internal political issues and definitely external media ones, though. Nobody wants to be the person who says "We're vulnerable, but I don't care enough to fix it". That's how you get internal political battles. Denial solves that problem. When dealing with external reports, it means ammunition for dealing with third parties. "We are not aware of any such vulnerabilities" becomes a defensible position, as does telling reporters that you dispute the claims of vulnerability. Those buy time to maybe fix something. And, well, there's the CYA psychology too. Nobody wants to confront the idea that they, or their smart and hard-working coworkers, screwed up to the point of creating a significant vulnerability.

kerng 8y ago

Something similar happened to me with Amazon a while back. Found some vulns, and they fixed them but never publicly acknowledged them - because they said "the cloud is always patched", so no need to tell anyone- which I thought was an odd response.

rocketChat 8y ago
Same for the RocketChat developers: https://github.com/RocketChat/Rocket.Chat/pull/10793 https://github.com/RocketChat/Rocket.Chat/pull/10793 "We do not disclose security fixes as soon we have them fixed to prevent bad guys to exploit them." "as soon we have" means never. They believe bad guys would not monitor the commits of target products.
- lysp 8y ago
  Not disclosing in release change logs potentially increase the chance of people being affected. If I see a changelog with XSS fixed I will update a product straight away, if I don't - I might leave it a week or two until I have time.

ctz 8y ago

I had a similar experience a few years back with Google (specifically the Android security team). Eager to get the issue fixed, but not in public disclosure or acknowledgement.

bdcravens 8y ago

Personally I've been turned off by Docker the company on numerous occasions. (Still love docker the project) Are there any inroads to a truly open source implementation of Docker for Mac and Windows? (Though I assume running a Linux VM would suffice?) It seems unfortunate that the default is running a non-open binary.