4 ms·

What if it's something nasty like Spectre, where you're coordinating at least getting some mitigations across multiple ecosystems, and disclosing the vulnerabil

What if it's something nasty like Spectre, where you're coordinating at least getting some mitigations across multiple ecosystems, and disclosing the vulnerabilities (particularly, say, the Meltdown fun, or NetSpectre) without available mitigation could be disastrous? 90d seems like sufficient time for many processes, particularly if you're used to iterating in somewhat flexible or always-releasable environments, but as soon as you start involving multiple systems with different timetables, the time requirements to meet everyone's process needs can balloon, particularly if it's something requiring substantial changes (and thus, substantial testing). (I'm in favor of the default 90d disclosure policy, just wanted to point out that there are sometimes legitimate justifications for longer timelines.) (Work for elgooG, not on anything remotely related to GPZ, opinions my own, etc.)

mseri 8y ago
Imho meltdown/spectre is a bad example from this point of view: it was dealt with very badly, with lack on information to some players (e.g. openbsd if I recall correctly), and earlier disclosure than agreed (with potentially some patches rushed out the door because they were meant for days later)
- rincebrain 8y ago
  IIRC OSes that weren't Windows/OSX/Linux didn't get invited to play in the embargo sandbox either until very late or not at all, so e.g. illumos and the BSDs were either completely in the dark or caught with relatively little time to do anything, especially because people inferred a bunch of the details before the embargo was supposed to expire from various patches and snippets of information leaking. There was also the issue that gregKH complained about, where the different major Linux distros on the embargo basically got siloed by Intel out of talking to each other, so they ended up building their own solutions. [3] [1] suggests FBSD got to the NDA sandbox relatively shortly before it went public. [2] says OpenBSD indeed did not. [1] - https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html https://lists.freebsd.org/pipermail/freebsd-security/2018-Ja... [2] - https://marc.info/?l=openbsd-tech&m=151521435721902 https://marc.info/?l=openbsd-tech&m=151521435721902 [3] - https://www.eweek.com/security/linux-kernel-developer-criticizes-intel-for-meltdown-spectre-response https://www.eweek.com/security/linux-kernel-developer-critic...
jve 8y ago
> What if it's something nasty like Spectre Exceptional case. Deadline WAS extended. Reported 01. Jun 2017, Disclosed Jan 2018 https://bugs.chromium.org/p/project-zero/issues/detail?id=1272 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- kps 8y ago
  Here is the list of (fixed, public) cases where the deadline was extended (sorted by vendor): https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Grace&sort=vendor&colspec=ID%20Reported%20Vendor%20Product%20Summary https://bugs.chromium.org/p/project-zero/issues/list?can=1&q... and here is the list bugs where the deadline expired: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Exceeded&sort=vendor&colspec=ID%20Status%20Reported%20Vendor%20Product%20Summary https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
Semaphor 8y ago
I remember (but I might be misremembering) one case of an AV Vendor getting the deadline extended by a day or two as they promised the patch is as good as done. When nothing happened, Google published.

mseri 8y ago

Imho meltdown/spectre is a bad example from this point of view: it was dealt with very badly, with lack on information to some players (e.g. openbsd if I recall correctly), and earlier disclosure than agreed (with potentially some patches rushed out the door because they were meant for days later)

rincebrain 8y ago
IIRC OSes that weren't Windows/OSX/Linux didn't get invited to play in the embargo sandbox either until very late or not at all, so e.g. illumos and the BSDs were either completely in the dark or caught with relatively little time to do anything, especially because people inferred a bunch of the details before the embargo was supposed to expire from various patches and snippets of information leaking. There was also the issue that gregKH complained about, where the different major Linux distros on the embargo basically got siloed by Intel out of talking to each other, so they ended up building their own solutions. [3] [1] suggests FBSD got to the NDA sandbox relatively shortly before it went public. [2] says OpenBSD indeed did not. [1] - https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html https://lists.freebsd.org/pipermail/freebsd-security/2018-Ja... [2] - https://marc.info/?l=openbsd-tech&m=151521435721902 https://marc.info/?l=openbsd-tech&m=151521435721902 [3] - https://www.eweek.com/security/linux-kernel-developer-criticizes-intel-for-meltdown-spectre-response https://www.eweek.com/security/linux-kernel-developer-critic...

jve 8y ago

> What if it's something nasty like Spectre Exceptional case. Deadline WAS extended. Reported 01. Jun 2017, Disclosed Jan 2018 https://bugs.chromium.org/p/project-zero/issues/detail?id=1272 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

kps 8y ago
Here is the list of (fixed, public) cases where the deadline was extended (sorted by vendor): https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Grace&sort=vendor&colspec=ID%20Reported%20Vendor%20Product%20Summary https://bugs.chromium.org/p/project-zero/issues/list?can=1&q... and here is the list bugs where the deadline expired: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Exceeded&sort=vendor&colspec=ID%20Status%20Reported%20Vendor%20Product%20Summary https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

Semaphor 8y ago

I remember (but I might be misremembering) one case of an AV Vendor getting the deadline extended by a day or two as they promised the patch is as good as done. When nothing happened, Google published.