3 ms·

Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, b

Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do. I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.

busterarm 8y ago
What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
- eridius 8y ago
  I'm not sure what your point is. If you're aware that an embargo exists, then you're aware that patches are already being worked on. Telling the world that a vulnerability exists in a particular product, without knowing the details, doesn't cause patches to materialize that wouldn't have otherwise (remember, the patches are already in progress), all it does is enable attackers to concentrate on that product. And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
  - busterarm 8y ago
    The patches are already in progress for folks that are part of the embargo. Not anyone else. BSDs, Linux distros that aren't RHEL or Debian based, and niche OS almost always get left out in the cold.

busterarm 8y ago

What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.

eridius 8y ago
I'm not sure what your point is. If you're aware that an embargo exists, then you're aware that patches are already being worked on. Telling the world that a vulnerability exists in a particular product, without knowing the details, doesn't cause patches to materialize that wouldn't have otherwise (remember, the patches are already in progress), all it does is enable attackers to concentrate on that product. And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
- busterarm 8y ago
  The patches are already in progress for folks that are part of the embargo. Not anyone else. BSDs, Linux distros that aren't RHEL or Debian based, and niche OS almost always get left out in the cold.