3 ms·

Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which i

Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.

reificator 8y ago
So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.
- mannykannot 8y ago
  > At which point why not just stop being proactive? The attitude that absence of evidence should be treated as if it didn't happen leads to exactly that conclusion - that it's better to not be able to tell what's happening.
buzer 8y ago
If that ever becomes standard, every actually relevant notification would be lost in the noise. Multiple local privilege escalation vulnerabilities are discovered yearly in both Linux and Windows (along with many other OSes and userland applications). Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day they were created until date X each time that happens? After all, there is no way to prove no one abused that before their systems were patched (including the period between system creation and vulnerability being publicly released).
- CaptSpify 8y ago
  > Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day... I'd love for that to happen. Maybe then everyone will start to pick up on the fact that all of our computer systems are insanely insecure.
  - davidcbc 8y ago
    It is much more likely in my opinion that people would become desensitized to data breaches and stop taking any of them seriously. Equifax or Cambridge Analytica would have been just another in a deluge of notifications.
UncleMeat 8y ago
Does your place of business inform for every closed xss bug? Sqli? Every buffer overrun? Directory traversal? The bar for "bug that could potentially lead to access to user data" is so low that I'd say that any business that isn't finding hundreds of these bugs a year isn't doing a serious job on security.
- dleslie 8y ago
  We try to, yes.
Kalium 8y ago
Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.
- dleslie 8y ago
  Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...
  - Kalium 8y ago
    https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
    - dleslie 8y ago
      Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.
spdionis 8y ago
You are hereby informed that all technology systems may have vulnerabilities that may be exploited. Duh.

Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.

reificator 8y ago

So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.

mannykannot 8y ago
> At which point why not just stop being proactive? The attitude that absence of evidence should be treated as if it didn't happen leads to exactly that conclusion - that it's better to not be able to tell what's happening.

buzer 8y ago

If that ever becomes standard, every actually relevant notification would be lost in the noise. Multiple local privilege escalation vulnerabilities are discovered yearly in both Linux and Windows (along with many other OSes and userland applications). Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day they were created until date X each time that happens? After all, there is no way to prove no one abused that before their systems were patched (including the period between system creation and vulnerability being publicly released).

CaptSpify 8y ago
> Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day... I'd love for that to happen. Maybe then everyone will start to pick up on the fact that all of our computer systems are insanely insecure.
- davidcbc 8y ago
  It is much more likely in my opinion that people would become desensitized to data breaches and stop taking any of them seriously. Equifax or Cambridge Analytica would have been just another in a deluge of notifications.

UncleMeat 8y ago

Does your place of business inform for every closed xss bug? Sqli? Every buffer overrun? Directory traversal? The bar for "bug that could potentially lead to access to user data" is so low that I'd say that any business that isn't finding hundreds of these bugs a year isn't doing a serious job on security.

dleslie 8y ago
We try to, yes.

Kalium 8y ago

Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.

dleslie 8y ago
Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...
- Kalium 8y ago
  https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
  - dleslie 8y ago
    Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.

spdionis 8y ago

You are hereby informed that all technology systems may have vulnerabilities that may be exploited. Duh.