5 ms·

Would it have been possible to tell Theo "hey, a serious issue is going to be released at <deadline>. I know you have a big release coming up. I strongly advise

Would it have been possible to tell Theo "hey, a serious issue is going to be released at <deadline>. I know you have a big release coming up. I strongly advise you to delay the release by a week so you can properly react to the disclosure. I'd tell you now, but I don't trust you not to break the embargo". I don't know if it would actually work, but that would at least put responsibility for handling this on Theo.

cperciva 8y ago
I was dealing with a multi-vendor security vulnerability in 2005. I asked Theo some questions, determined that OpenBSD wasn't affected, and told him "ok, nothing to worry about here". Theo's response was to (a) announce to the world at large that I was coordinating disclosure of a major vulnerability, and (b) threaten to withhold information about OpenSSH vulnerabilities from FreeBSD unless I shared details about this vulnerability with him -- even though it didn't affect OpenBSD! So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is".
- eridius 8y ago
  Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do. I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.
  - busterarm 8y ago
    What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
    - eridius 8y ago
      I'm not sure what your point is. If you're aware that an embargo exists, then you're aware that patches are already being worked on. Telling the world that a vulnerability exists in a particular product, without knowing the details, doesn't cause patches to materialize that wouldn't have otherwise (remember, the patches are already in progress), all it does is enable attackers to concentrate on that product. And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
      - busterarm 8y ago
        The patches are already in progress for folks that are part of the embargo. Not anyone else. BSDs, Linux distros that aren't RHEL or Debian based, and niche OS almost always get left out in the cold.
- shawn 8y ago
  It's not really fair to say that someone's behavior in 2018 is determined by who they were in 2005. No atom in their body is even the same. (Supposedly.)
- drb91 8y ago
  > So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is". This actually sound quite reasonable to me.
  - AdamJacobMuller 8y ago
    The problem comes if someone is specifically involved with a specific project. You've just seriously narrowed the search space for new vulnerabilities for someone by several orders of magnitude. The specific person who is named, or the organization who is releasing the information, may narrow the search space even further.
    - drb91 8y ago
      Sooner or later one of these vendors will start leaking without Theo’s grace and the embargo will protect the exploiters. I say axe the embargo and get into a habit of real time incident management.
    - HelloNurse 8y ago
      What about caring for users? If I know X is vulnerable I can decide to disable X by default for all OpenBSD users without needing to know the details. Knowing the details would make the difference between drastic and inconvenient mitigations (maybe no graphics at all) and just "disabling legacy drivers and lose the setuid bit". If after my warning hackers start focusing on X, my users are already on the run: it isn't a problem for them.

cperciva 8y ago

I was dealing with a multi-vendor security vulnerability in 2005. I asked Theo some questions, determined that OpenBSD wasn't affected, and told him "ok, nothing to worry about here". Theo's response was to (a) announce to the world at large that I was coordinating disclosure of a major vulnerability, and (b) threaten to withhold information about OpenSSH vulnerabilities from FreeBSD unless I shared details about this vulnerability with him -- even though it didn't affect OpenBSD! So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is".

eridius 8y ago
Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do. I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.
- busterarm 8y ago
  What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
  - eridius 8y ago
    I'm not sure what your point is. If you're aware that an embargo exists, then you're aware that patches are already being worked on. Telling the world that a vulnerability exists in a particular product, without knowing the details, doesn't cause patches to materialize that wouldn't have otherwise (remember, the patches are already in progress), all it does is enable attackers to concentrate on that product. And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
    - busterarm 8y ago
      The patches are already in progress for folks that are part of the embargo. Not anyone else. BSDs, Linux distros that aren't RHEL or Debian based, and niche OS almost always get left out in the cold.
shawn 8y ago
It's not really fair to say that someone's behavior in 2018 is determined by who they were in 2005. No atom in their body is even the same. (Supposedly.)
drb91 8y ago
> So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is". This actually sound quite reasonable to me.
- AdamJacobMuller 8y ago
  The problem comes if someone is specifically involved with a specific project. You've just seriously narrowed the search space for new vulnerabilities for someone by several orders of magnitude. The specific person who is named, or the organization who is releasing the information, may narrow the search space even further.
  - drb91 8y ago
    Sooner or later one of these vendors will start leaking without Theo’s grace and the embargo will protect the exploiters. I say axe the embargo and get into a habit of real time incident management.
  - HelloNurse 8y ago
    What about caring for users? If I know X is vulnerable I can decide to disable X by default for all OpenBSD users without needing to know the details. Knowing the details would make the difference between drastic and inconvenient mitigations (maybe no graphics at all) and just "disabling legacy drivers and lose the setuid bit". If after my warning hackers start focusing on X, my users are already on the run: it isn't a problem for them.