4 ms·

Why does every new attack have a homepage these days?

CiPHPerCoder 7y ago
Ever reported a security vulnerability to a company and had it severely downplayed before?
KenanSulayman 7y ago
Came here to ask the same. Then thought about it and was expecting to see a comment saying “it’s so that normal people understand the vulnerabilities.” And then I realized it’s probably also because of a desire to be seen. (It seems all participants are from academia?)
- uponcoffee 7y ago
  It's hard to talk about things without names. You could use the CVE but it's hard to remember one from the other and is about the same as using no names.
- penagwin 7y ago
  If you discovered a way to read privileged memory from any process, wouldn't you want people to know about it, and that you played a part in discovering it? Why not have somebody slap a logo on it too?
tareqak 7y ago
I forget if heartbleed was the first one to a have a homepage or the first one to have a catchy name, but it was to help with the public relations angle of convincing CIOs or their equivalents in an organization to take the problem seriously AFAIK. Someone else here can probably answer it better.
- 2bitencryption 7y ago
  On this subject, I'd love to see a full history of the "branded vulnerability" thing.
  - deleted 7y ago
    [deleted]
  - tareqak 7y ago
    Here is a link up thread with 'patio11's take on it: https://news.ycombinator.com/item?id=20158079 https://news.ycombinator.com/item?id=20158079 .
- __jal 7y ago
  There were nicely branded jailbreaks for the iPhone well before Heartbleed.
JMTQp8lwXL 7y ago
I imagine these researchers are proud of their findings and want to promote their work and their own personal brands. Name recognition is a big part of academia. You'll notice a "People" section immediately following the description of the vulnerability.
- Cyph0n 7y ago
  This paper was accepted at IEEE S&P, which is arguably the best security conference in the world, so I don't think these guys will be lacking when it comes to recognition!
artiscode 7y ago
I personally find much easier to fully understand the implications of a security vulnerability that can affect me and my side projects. I'm a full time front-end dev and I do not follow security news explicitly. If severe vulnerabilities have dedicated home pages then it's easier to spread awareness and more people end up sharing the same resource thus keeping people updated easily
roywiggins 7y ago
This one's a novel iteration of Rowhammer, and people find Rowhammer interesting.
PeterisP 7y ago
It kind of makes sense for all the fundamental hardware vulnerabilities. For most software vulnerabilities, the main takeaway message for the layperson is "yesterday's release of TheThing fixes some bad stuff. Don't use old versions, update to the new release" and the details matter only for the specialists. For attacks like Rowhammer or Meltdown or Spectre or this one, however, there's lots of information that's still going to be relevant years after the publication - many people will have vulnerable hardware that will stay vulnerable, and you can still buy vulnerable hardware and so need to evaluate if your situation requires specific hardware choices to avoid these vulnerabilities, etc. So a long-term informative website is pretty much necessary.

Ever reported a security vulnerability to a company and had it severely downplayed before?

Came here to ask the same. Then thought about it and was expecting to see a comment saying “it’s so that normal people understand the vulnerabilities.” And then I realized it’s probably also because of a desire to be seen. (It seems all participants are from academia?)

uponcoffee 7y ago
It's hard to talk about things without names. You could use the CVE but it's hard to remember one from the other and is about the same as using no names.
penagwin 7y ago
If you discovered a way to read privileged memory from any process, wouldn't you want people to know about it, and that you played a part in discovering it? Why not have somebody slap a logo on it too?

tareqak 7y ago

I forget if heartbleed was the first one to a have a homepage or the first one to have a catchy name, but it was to help with the public relations angle of convincing CIOs or their equivalents in an organization to take the problem seriously AFAIK. Someone else here can probably answer it better.

2bitencryption 7y ago
On this subject, I'd love to see a full history of the "branded vulnerability" thing.
- deleted 7y ago
  [deleted]
- tareqak 7y ago
  Here is a link up thread with 'patio11's take on it: https://news.ycombinator.com/item?id=20158079 https://news.ycombinator.com/item?id=20158079 .
__jal 7y ago
There were nicely branded jailbreaks for the iPhone well before Heartbleed.

JMTQp8lwXL 7y ago

I imagine these researchers are proud of their findings and want to promote their work and their own personal brands. Name recognition is a big part of academia. You'll notice a "People" section immediately following the description of the vulnerability.

Cyph0n 7y ago
This paper was accepted at IEEE S&P, which is arguably the best security conference in the world, so I don't think these guys will be lacking when it comes to recognition!

artiscode 7y ago

I personally find much easier to fully understand the implications of a security vulnerability that can affect me and my side projects. I'm a full time front-end dev and I do not follow security news explicitly. If severe vulnerabilities have dedicated home pages then it's easier to spread awareness and more people end up sharing the same resource thus keeping people updated easily

roywiggins 7y ago

This one's a novel iteration of Rowhammer, and people find Rowhammer interesting.

PeterisP 7y ago

It kind of makes sense for all the fundamental hardware vulnerabilities. For most software vulnerabilities, the main takeaway message for the layperson is "yesterday's release of TheThing fixes some bad stuff. Don't use old versions, update to the new release" and the details matter only for the specialists. For attacks like Rowhammer or Meltdown or Spectre or this one, however, there's lots of information that's still going to be relevant years after the publication - many people will have vulnerable hardware that will stay vulnerable, and you can still buy vulnerable hardware and so need to evaluate if your situation requires specific hardware choices to avoid these vulnerabilities, etc. So a long-term informative website is pretty much necessary.