3 ms·
I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actu
by yumraj 7y ago
I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actual exploit, and the fact that it had been communicated to the company so that a public countdown of the 90-day window can happen.
The exploit can then be divulged to the public, automatically, on the expiration of the 90-day window, regardless of whether it's fixed or not, as that may also be educational.
For example, after this Zoom issue other companies will hesitate to use a localhost webserver, but if the issue had quietly been fixed by Zoom other companies may still have been tempted to use similar approach.
- enneff 7y agoMore often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is there than to just experiment blindly.
- yumraj 7y agoFair enough, but that can be countered by very minimal disclosure in the beginning, just that a vulnerability exists and it has been notified. Even if we don't do that, I think we should at least reveal the issue after it's been fixed in all the cases so that other entities can learn from that.
- o-__-o 7y agoYes. I learned the security release process for a major open source software and it became trivial to determine when vulnerabilities are patched and knowledge of their build process gives you an exact window to exploit said 0-day
- pdkl95 7y agoThere isn't a 1-size-fits-all solution to this type of situation. Giving the company a reasonable time[1] to fix it is a good guideline to start with, but determining the best approach to use requires making several judgment calls. Is the exploit already being used in the wild? Should affected users be doing something asap to protect themselves? How quickly could someone transform your disclosure into something malicious? How much risk are we forcing the users to bear while we wait for a self-imposed arbitrary time limit to expire. Is there an actual benefit to be gained by delaying public disclosure? (Is the company using the time responsibly to implement a fix, or are they denying the problem exists? Handling a public disclosure meas adapting to the specific risks of the situation. [1] I would say 30 days is more appropriate, with the option to delay the public announcement if the company has handled the situation well and is working on the fix, but needs more time for a legitimate technical reason.