5 ms·

This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do wh

by lvh 8y ago

This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do whatever song and dance the person who are actually responsible want. That's nonsense: if you find the bug you get to do whatever you want with that information. (Including, I think, trade on it? But I'm not a lawyer and that's not legal advice.)

pavel_lishin 8y ago
> the onus is on security researchers to do whatever song and dance the person who are actually responsible want It's not about bending to the will of an incompetent idiot; it's about protecting vulnerable end users from the idiot in question.
- lvh 8y ago
  Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure. A lot of projects/companies fortunately are not staffed by incompetent idiots. I'm also not saying "never disclose to the company/project". It's what I do 100% of the time if it's worth disclosing and I don't have prior evidence that they'll react poorly. I'm saying researchers have no moral obligation to do anything.
  - pavel_lishin 8y ago
    > I'm saying researchers have no moral obligation to do anything. I don't think I agree with you, but I understand your point of view, and don't think I can really argue from any sort of objective reasoning.
    - lvh 8y ago
      Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public the most? The bad guys can find vulns too, and you have no idea if you're the first to find a vulnerability, and we're presupposing the company won't handle it well. The _best outcome_ for the general public is full, immediate, public disclosure in that case! There are other arguments here, like the fact that random people putting bugs in websites are not entitled to a researcher's time.
      - baby 8y ago
        It's a spectrum, and unfortunately a lot of security researcher just assume that developers at companies are always the bad guys.
        lvh 8y ago
        Do you have any evidence of that claim? Also, even if it’s true, why does the company get to command the researcher’s time? Finally, as a company, you get to mitigate this by having a serious disclosure policy. It helps if you don’t look like the bad guys.
        baby 8y ago
        > Do you have any evidence of that claim? I'm not going to link to specific github issues but I've seen enough people dropping "vulnerabilities" and yelling at the developers. (I'm pretty sure you know what I'm talking about.) This often gets the developers worked out and gives security people a bad rap. It's a lose-lose situation imo. People need to learn empathy and stop blaming developers. Of course there are companies that need to be shamed, and that will repeatedly act shady, but too many people use this to excuse their behavior in general.
      - pavel_lishin 8y ago
        I disagree that the best outcome is full immediate public disclosure. N (where N may be 0) bad actors abusing the vulnerability is not necessarily worse than releasing the vulnerability to where any script kiddie can abuse it. A direct example is right here - ArtChain is now completely unusable because someone decided it would be funny to redirect their homepage to Pornhub. Sure, they had it coming, but I'd wager at least a few readers here had to hurried explain to a coworker why they were looking at porn at work. (Granted, it's not a good example, because the researcher in question did reach out, and the incompetent idiot showed his ass to the entire internet, but immediate full disclosure would have had the same effect.) I also agree that just sitting on the vuln and pleading with an idiot is not a productive use of anyone's time.
        8y ago

by lvh 8y ago

pavel_lishin 8y ago

> the onus is on security researchers to do whatever song and dance the person who are actually responsible want It's not about bending to the will of an incompetent idiot; it's about protecting vulnerable end users from the idiot in question.

lvh 8y ago
Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure. A lot of projects/companies fortunately are not staffed by incompetent idiots. I'm also not saying "never disclose to the company/project". It's what I do 100% of the time if it's worth disclosing and I don't have prior evidence that they'll react poorly. I'm saying researchers have no moral obligation to do anything.
- pavel_lishin 8y ago
  > I'm saying researchers have no moral obligation to do anything. I don't think I agree with you, but I understand your point of view, and don't think I can really argue from any sort of objective reasoning.
  - lvh 8y ago
    Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public the most? The bad guys can find vulns too, and you have no idea if you're the first to find a vulnerability, and we're presupposing the company won't handle it well. The _best outcome_ for the general public is full, immediate, public disclosure in that case! There are other arguments here, like the fact that random people putting bugs in websites are not entitled to a researcher's time.
    - baby 8y ago
      It's a spectrum, and unfortunately a lot of security researcher just assume that developers at companies are always the bad guys.
      - lvh 8y ago
        Do you have any evidence of that claim? Also, even if it’s true, why does the company get to command the researcher’s time? Finally, as a company, you get to mitigate this by having a serious disclosure policy. It helps if you don’t look like the bad guys.
        baby 8y ago
        > Do you have any evidence of that claim? I'm not going to link to specific github issues but I've seen enough people dropping "vulnerabilities" and yelling at the developers. (I'm pretty sure you know what I'm talking about.) This often gets the developers worked out and gives security people a bad rap. It's a lose-lose situation imo. People need to learn empathy and stop blaming developers. Of course there are companies that need to be shamed, and that will repeatedly act shady, but too many people use this to excuse their behavior in general.
    - pavel_lishin 8y ago
      I disagree that the best outcome is full immediate public disclosure. N (where N may be 0) bad actors abusing the vulnerability is not necessarily worse than releasing the vulnerability to where any script kiddie can abuse it. A direct example is right here - ArtChain is now completely unusable because someone decided it would be funny to redirect their homepage to Pornhub. Sure, they had it coming, but I'd wager at least a few readers here had to hurried explain to a coworker why they were looking at porn at work. (Granted, it's not a good example, because the researcher in question did reach out, and the incompetent idiot showed his ass to the entire internet, but immediate full disclosure would have had the same effect.) I also agree that just sitting on the vuln and pleading with an idiot is not a productive use of anyone's time.
      - 8y ago