5 ms·

Maybe I'm just too old and contankerious and just don't "get it" but warning Apple via Twitter[0] isn't really following a Coordinated Vulnerability Disclosure

Maybe I'm just too old and contankerious and just don't "get it" but warning Apple via Twitter[0] isn't really following a Coordinated Vulnerability Disclosure process, yeah? [0] - https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf https://resources.sei.cmu.edu/asset_files/SpecialReport/2017... EDIT: Changed the link to the CERT guide for CVD.

smt88 8y ago
The tweet wasn't the warning. The tweet describes the 14 year old's mom sending a formal notice of some kind. Anyway, it's absurd to say thay tweets aren't enough warning if they're public. A public disclosure may be distasteful to Apple, but it doesn't change the fact that they have a security emergency.
- renholder 8y ago
  >Anyway, it's absurd to say thay tweets aren't enough warning if they're public. Who said Tweets weren't enough warning? Did I say that? Where? ...and what does a warning have to do with CVD? The two precepts aren't mutually exclusive, yeah?
  - smt88 8y ago
    You yourself implied a relationship between CVD and the tweet when you said that a tweet isn’t a valid step in a CVD process.
benologist 8y ago
Apple staff should copy/paste the information reported to them on Twitter to the relevant team for triage or investigation. The user is already helping enough by telling them on Twitter.
- renholder 8y ago
  This is true but she had already emailed them and from the looks of the screenshot, recevied a response[0]? I still fail to see what that has to do with CVD, though? [0] - https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=/0x0:1672x806/920x0/filters:focal(0x0:1672x806):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/13723266/Screen_Shot_2019_01_29_at_2.07.07_PM.png https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=...
  - amanaplanacanal 8y ago
    It sounds like the problem was that she never got a response. She sent the original letter, never heard anything back from them, assumed it got lost or was ignored, and then tweeted.
ibero 8y ago
Reading that website you provided, the mother was correct to hit up twitter as they suggest that "Customers" contact Apple Support. Their twitter is an official channel to that end. The only area in that document she would have followed to reach out Apple's security contact is under the heading of "Security and privacy researchers", of which I am doubting she thought herself or her 14 year old son as.
- renholder 8y ago
  >...of which I am doubting she thought herself or her 14 year old son as. Yet, that[0] is precisely what she did...? Your argument falls on it's face by her own action[s]. EDIT: Note in the screenshot that there's an appended "Follow-Up" with what looks to be an ID, which has been added to the Subject field of the email. [0] - https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=/0x0:1672x806/920x0/filters:focal(0x0:1672x806):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/13723266/Screen_Shot_2019_01_29_at_2.07.07_PM.png https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=...
chrisseaton 8y ago
> isn't really following a Coordinated Vulnerability Disclosure process, yeah Why should they have followed that process? Coordinated Vulnerability Disclosure is just one way of many of disclosing security problems. It's not the single right way.
- renholder 8y ago
  >Why should they have followed that process? They started doing just that (didn't anyone actually read the article) and then decided they weren't gettig enough traction and tweeted at Apple. Then, someone discloses the full vulnerability later because.... ...reasons? CVD isn't the single right way, you're correct, but it allows the vendor to address the issue and remediate it, before the exploit is published. In fact, CERT states that they'll publish exploits after 45 days (I think it is) of non-repsonse from vendors. To me, it sounds like someone started going the right direction and someone else took over the PR-value of the loudest voice gets the most attention - which there is some arguments for/against that. However, since they already started going down the "right" road, I don't see why there's this crusade to say "all reports should be accepted through any channel". It's an untenable precept. Should start-ups or FOSS monitor social media for security reports? Don't they define reporting processes of their own? I'm not saying, "Don't ever use social media," which is what I'm gathering some people misunderstand this as. I'm saying, if they started down the reporting path, via the appropriate channels, then why disclose the vulernability publicly, if they were already going down the appropriate path? As someone else mentioned, it should've been on support to see the tweet and pass it on to the appropriate team; especially, since they had already opened a bug for it. Yet, I don't see how this automatically equates to just dumping the exploit into the public domain. (I hope my explanation of it makes sense, at least?)
  - chrisseaton 8y ago
    If we agree that they didn’t claim to be doing CVD, were under no obligation to be doing CVD, and CVD isn’t the only way, then why did you comment saying ‘this isnt CVD’ and post a definition as if they were confused about what CVD is? I mean it’s not relevant because that’s not what they were doing. You might as well comment ‘maybe I’m cantankerous but they don’t seem to be baking a cake here’. You’re right they weren’t baking a cake. So what of it?

smt88 8y ago

The tweet wasn't the warning. The tweet describes the 14 year old's mom sending a formal notice of some kind. Anyway, it's absurd to say thay tweets aren't enough warning if they're public. A public disclosure may be distasteful to Apple, but it doesn't change the fact that they have a security emergency.

renholder 8y ago
>Anyway, it's absurd to say thay tweets aren't enough warning if they're public. Who said Tweets weren't enough warning? Did I say that? Where? ...and what does a warning have to do with CVD? The two precepts aren't mutually exclusive, yeah?
- smt88 8y ago
  You yourself implied a relationship between CVD and the tweet when you said that a tweet isn’t a valid step in a CVD process.

benologist 8y ago

Apple staff should copy/paste the information reported to them on Twitter to the relevant team for triage or investigation. The user is already helping enough by telling them on Twitter.

renholder 8y ago
This is true but she had already emailed them and from the looks of the screenshot, recevied a response[0]? I still fail to see what that has to do with CVD, though? [0] - https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=/0x0:1672x806/920x0/filters:focal(0x0:1672x806):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/13723266/Screen_Shot_2019_01_29_at_2.07.07_PM.png https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=...
- amanaplanacanal 8y ago
  It sounds like the problem was that she never got a response. She sent the original letter, never heard anything back from them, assumed it got lost or was ignored, and then tweeted.

ibero 8y ago

Reading that website you provided, the mother was correct to hit up twitter as they suggest that "Customers" contact Apple Support. Their twitter is an official channel to that end. The only area in that document she would have followed to reach out Apple's security contact is under the heading of "Security and privacy researchers", of which I am doubting she thought herself or her 14 year old son as.

renholder 8y ago
>...of which I am doubting she thought herself or her 14 year old son as. Yet, that[0] is precisely what she did...? Your argument falls on it's face by her own action[s]. EDIT: Note in the screenshot that there's an appended "Follow-Up" with what looks to be an ID, which has been added to the Subject field of the email. [0] - https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=/0x0:1672x806/920x0/filters:focal(0x0:1672x806):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/13723266/Screen_Shot_2019_01_29_at_2.07.07_PM.png https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=...

chrisseaton 8y ago

> isn't really following a Coordinated Vulnerability Disclosure process, yeah Why should they have followed that process? Coordinated Vulnerability Disclosure is just one way of many of disclosing security problems. It's not the single right way.

renholder 8y ago
>Why should they have followed that process? They started doing just that (didn't anyone actually read the article) and then decided they weren't gettig enough traction and tweeted at Apple. Then, someone discloses the full vulnerability later because.... ...reasons? CVD isn't the single right way, you're correct, but it allows the vendor to address the issue and remediate it, before the exploit is published. In fact, CERT states that they'll publish exploits after 45 days (I think it is) of non-repsonse from vendors. To me, it sounds like someone started going the right direction and someone else took over the PR-value of the loudest voice gets the most attention - which there is some arguments for/against that. However, since they already started going down the "right" road, I don't see why there's this crusade to say "all reports should be accepted through any channel". It's an untenable precept. Should start-ups or FOSS monitor social media for security reports? Don't they define reporting processes of their own? I'm not saying, "Don't ever use social media," which is what I'm gathering some people misunderstand this as. I'm saying, if they started down the reporting path, via the appropriate channels, then why disclose the vulernability publicly, if they were already going down the appropriate path? As someone else mentioned, it should've been on support to see the tweet and pass it on to the appropriate team; especially, since they had already opened a bug for it. Yet, I don't see how this automatically equates to just dumping the exploit into the public domain. (I hope my explanation of it makes sense, at least?)
- chrisseaton 8y ago
  If we agree that they didn’t claim to be doing CVD, were under no obligation to be doing CVD, and CVD isn’t the only way, then why did you comment saying ‘this isnt CVD’ and post a definition as if they were confused about what CVD is? I mean it’s not relevant because that’s not what they were doing. You might as well comment ‘maybe I’m cantankerous but they don’t seem to be baking a cake here’. You’re right they weren’t baking a cake. So what of it?