4 ms·

By definition (https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure) this is not "Responsible", but I don't

By definition (https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure) this is not "Responsible", but I don't believe it's little-r responsible either. They should have at least told the operators and TC simultaneously, and not (according to the article) relied on TC to tell the operators.

tptacek 8y ago
"Responsible disclosure" is an Orwellian term coined by vendors to coerce researchers. The accepted term among professional researchers is "coordinated disclosure". This wasn't coordinated disclosure, but not all disclosure has to be. https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2...
- chris_wot 8y ago
  Surely though the point of coordinating a disclosure is to responsibly ensure that nobody is needlessly put at risk whilst the vendor works on a fix?
  - tptacek 8y ago
    That's a false dichotomy. Coordinated disclosure can sometimes optimize outcomes for some subset of users. Sometimes it doesn't. Ethical judgements in vulnerability disclosure are complicated. Sometimes a vendor and the majority of its user community would prefer disclosure be suppressed, because it saves them work (see: "Patch Tuesday"). Sometimes that impulse lines up with what's best for the world, and sometimes it doesn't. See what's so Orwellian about "responsible disclosure" now? The whole point of rejecting the term is that there isn't a one-sized-fits-all answer, to which you must comply in order to be "responsible". Anyways: hard no to the suggestion that, in order to be a "real researcher", you have to coordinate your disclosures. To be a serious researcher, you just have to be serious about finding vulnerabilities. (Semantic reminder: our field uses the term "researcher" in a way closer to the journalism definition of the word than the academia definition.)
    - chris_wot 8y ago
      Fair comment, that's a reasonable answer. Thanks :-)
  - lvh 8y ago
    I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments: - Discovery didn't create the bug. You have no idea who has been exploiting the shit out of it already. - Vendors will have all sorts of unreasonable responses, from ignoring you to threatening legal action to dragging their feet. - Vulns are work product. You are entitled to zero of the researcher's time and effort unless you're paying them for it. I'm not saying coordinated disclosure is bad either! I prefer to do it when I find stuff. We found a bug in NextJS last week and we did coordinated disclosure (I'm talking about it now because they released a fix). I'm saying the researcher owns the bug. EDIT: Oh no! Of course he beat me to it.
  - deleted 8y ago
    [deleted]
  - chrisseaton 8y ago
    > ensure that nobody is needlessly put at risk People are needlessly at risk if they’re still using a vulnerable service they could have been told not to use while you wait for the vendor.

tptacek 8y ago

"Responsible disclosure" is an Orwellian term coined by vendors to coerce researchers. The accepted term among professional researchers is "coordinated disclosure". This wasn't coordinated disclosure, but not all disclosure has to be. https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2...

chris_wot 8y ago
Surely though the point of coordinating a disclosure is to responsibly ensure that nobody is needlessly put at risk whilst the vendor works on a fix?
- tptacek 8y ago
  That's a false dichotomy. Coordinated disclosure can sometimes optimize outcomes for some subset of users. Sometimes it doesn't. Ethical judgements in vulnerability disclosure are complicated. Sometimes a vendor and the majority of its user community would prefer disclosure be suppressed, because it saves them work (see: "Patch Tuesday"). Sometimes that impulse lines up with what's best for the world, and sometimes it doesn't. See what's so Orwellian about "responsible disclosure" now? The whole point of rejecting the term is that there isn't a one-sized-fits-all answer, to which you must comply in order to be "responsible". Anyways: hard no to the suggestion that, in order to be a "real researcher", you have to coordinate your disclosures. To be a serious researcher, you just have to be serious about finding vulnerabilities. (Semantic reminder: our field uses the term "researcher" in a way closer to the journalism definition of the word than the academia definition.)
  - chris_wot 8y ago
    Fair comment, that's a reasonable answer. Thanks :-)
- lvh 8y ago
  I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments: - Discovery didn't create the bug. You have no idea who has been exploiting the shit out of it already. - Vendors will have all sorts of unreasonable responses, from ignoring you to threatening legal action to dragging their feet. - Vulns are work product. You are entitled to zero of the researcher's time and effort unless you're paying them for it. I'm not saying coordinated disclosure is bad either! I prefer to do it when I find stuff. We found a bug in NextJS last week and we did coordinated disclosure (I'm talking about it now because they released a fix). I'm saying the researcher owns the bug. EDIT: Oh no! Of course he beat me to it.
- deleted 8y ago
  [deleted]
- chrisseaton 8y ago
  > ensure that nobody is needlessly put at risk People are needlessly at risk if they’re still using a vulnerable service they could have been told not to use while you wait for the vendor.