5 ms·

> End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce speciali

> End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Why should end-users "have nothing but gratitude" when vulnerabilities are disclosed and they are immediately placed at risk until they get a chance to update, even when the vendor has promptly provided a correct patch? I know I certainly don't appreciate that and can't reasonably expect any normal person to appreciate it either.

tptacek 7y ago
Obviously, because the alternative is that bugs never get patched, and get independently discovered by people who sell them to brokers instead. If you want to get angry about this, get angry at the vendor that took your money and time and attention and gave you a product with an exploitable security vulnerability in it. I think the issues involved here are a bit subtle to warrant knee-jerk anger, but if you've got to get angry, at least get angry in the right direction.
- mehrdadn 7y ago
  What? I'm asking about why disclosures happen when patches are provided promptly. I'm not objecting to disclosing when they aren't. How does that "obviously" mean "that bugs never get patched"?
  - tptacek 7y ago
    The disclosures motivate the patches. We're not guessing about that; we have a before/after picture of the industry prior to mandatory disclosure windows.
    - mehrdadn 7y ago
      Disclosing when a patch is NOT provided should motivate prompt patches. Nobody is disputing that. But you're saying disclosure when a prompt patch IS provided motivates patches further, and that's not even just a guess? How...?
      - masklinn 7y ago
        > But you're saying disclosure when a prompt patch IS provided motivates patches further, and that's not even just a guess? How…? 1. because the policy is "mandatory disclosure", it's way harder to criticise it if it's a blanket, universal policy 2. disclosure is important for users (in general though mostly corporate) because if the issue is not publicly disclosed they might not update their systems (assuming issues are minor or irrelevant)
        mehrdadn 7y ago
        > 1. because the policy is "mandatory disclosure", it's way harder to criticise it if it's a blanket, universal policy "It's harder to criticize"? So the reason to put users at risk is to... solve a PR problem? > 2. disclosure is important for users because if the issue is not publicly disclosed they might not update their systems Hold on. You're actively injecting a threat and guaranteeing that everyone knows the exploit immediately and that it can be deployed by lots of people on a wide scale because someone might discover it someday? Can't you just at least easily address this by at least putting a reasonably long time gap between the patch and the disclosure? People will still have to update their systems in the interim due to previous patches' deadlines expiring...
        PKop 7y ago
        Seems like the disconnect between you and others is your assumption there is some time gap of knowledge about the exploit after the patch is released. Others have stated that almost immediately after patches are released they are reverse engineered to discover the exploits. So at that time, motivating people to upgrade to the patch is all benefit no? If they're wrong about their assumptions, you might have a point. If you're wrong, what's the dispute?
        mehrdadn 7y ago
        Yes, but a time gap of knowledge is just one dimension, whereas I see a gap in every other dimension too. I expect that not every bad actor who would learn from a PoC would learn from a binary, not every one who would learn that actually invest the time to write an exploit, not every one who invests the time would actually come up with an exploit in such a short timespan, and not everyone who does all that will target the same set of customers. Furthermore, as I said in another comment, the existence of prior patches would mean people would still have to update regularly because those disclosures would be expiring anyway, so it's not at all clear to me adding a delay would change that. And there are probably other dimensions I can't think of right off the top of my head. There should be an easy way to settle this, which is with data, which I have not yet seen anyone point to. I would be shocked if data showed that the number of actual customer systems hacked actually decreases when a PoC is provided quickly after a patch, vs. when this is not the case.
growse 7y ago
They were at risk before they knew about the vulnerability. The gratitude is for the fact that it now actually gets patched.
- mehrdadn 7y ago
  For getting the patch, there is gratitude. Why should they feel nicely about the following disclosure though?
  - brohee 7y ago
    For all purpose, the patch is disclosure.
  - tptacek 7y ago
    This is backwards. The patch is something you're getting from the vendor that put you at risk in the first place.
    - mehrdadn 7y ago
      Instead of telling me I'm being "backwards" about what people should appreciate and what they shouldn't, it'd be more helpful if you could explain your own thoughts like I asked you on the comment above (not here): https://news.ycombinator.com/item?id=20567651 https://news.ycombinator.com/item?id=20567651 I certainly don't follow your logic.
      - deleted 7y ago
        [deleted]
      - deleted 7y ago
        [deleted]
      - tptacek 7y ago
        Why would I do that? None of your arguments on this thread appear to have been persuasive, judging from the pallor the text they're displayed in has taken. If it was just one or two comments, sure, who cares, but you've written a multitude of them, and none of them appear to be surviving. It feels like the burden of proof falls rather more strongly on you than on me at this point.
wolf550e 7y ago
When the vendor provides a patch before the 90 day deadline, do you want P0 to never disclose the bug or to wait a month after patch was released, or what? I think you're complaining that P0 don't give users enough time to patch - e.g. disclosing one day after the patch was released. If so, that is fair and I think they could wait longer, but for things like Microsoft, Apple, Android, Chrome, etc. security patches - those are disassembled and diffed within hours of release, and for some vulnerabilities an exploit is ready within 24h, so P0 disclosing everything so defenders can for example prioritize installing the patches, turn off features/services, etc. is generally a good thing.
- mehrdadn 7y ago
  I mean, I'm not taking a hard position on what they should do, but I know (a) it shouldn't be immediate, and (b) logically one would think the logic would be "never disclose unless you can provide a compelling reason for doing so". I'm open to hearing a compelling reason, in which case I would think they should disclose after waiting a while, but I need to hear one first.
  - sp332 7y ago
    It's disclosed so that the customers know what the vulnerability is. Sometimes patching is not the best thing to do for a given situation. Other mitigations might be possible, or it might not even be an issue depending on how the software is used. Criminal researchers might have found this information anyway, so it's only fair to put the customers on an equal footing.
    - mehrdadn 7y ago
      > Criminal researchers might have found this information anyway, it's only fair to put the customers on an equal footing. Or they might not have, in which case you just gave them a pretty powerful weapon, and it's pretty unfair to customers?? > It's disclosed so that the customers know what the vulnerability is. Sometimes patching is not the best thing to do for a given situation. Other mitigations might be possible, or it might not even be an issue depending on how the software is used. Are you sure "because maybe you shouldn't the patch" is their logic here? (Which doesn't even necessitate this either, but everything I've seen indicates they want you to patch immediately.)
billyhoffman 7y ago
First: everyone is already at risk for everything that P0 finds. The difference is no one if publicly talking about the flaws or the risk in the open. Second: P0 never “immediately places people at risk” because they always follow responsible disclosure. P0 has a well documented and frankly fairly conservative policy before anything is publicly disclosed. Do vendors want more time to fix things? Sure, they always will. Do P0 disclosures sometimes happen publicly before the vendor has things fixed? Yes, Occasionally. However, looking at the net, P0 has provided far more value than they detract with public disclosure of flaws
- mehrdadn 7y ago
  > First: everyone is already at risk for everything that P0 finds. The difference is no one if publicly talking about the flaws or the risk in the open. You don't see how the risk might increase when more people learn about the vulnerability? > Second: P0 never “immediately places people at risk” because they always follow responsible disclosure. What? They provided proof-of-concept exploits just one week after the patch was provided. That's apparently not "immediate" in the eyes of security researchers, but try asking the average user if that's enough time to expect them to update. > P0 has a well documented and frankly fairly conservative policy before anything is publicly disclosed. Yes, and it could be worse, but it's also not great and could also be better. > Do vendors want more time to fix things? Sure, they always will. That was never my argument. I never said they should get more time to fix things. > Do P0 disclosures sometimes happen publicly before the vendor has things fixed? Yes, Occasionally. Again, I was specifically NOT arguing about disclosing before the patch is provided. > However, looking at the net, P0 has provided far more value than they detract with public disclosure of flaws And I never singled out P0 or claimed otherwise. I'm disputing the entire practice by whomever is practicing it.
  - jachee 7y ago
    iOS users tend to be relatively quick about upgrades. Plus, the publication of the announcement contributes to word-of-mouth dissemination of the existence of the vulnerability and prompts those who haven't updated yet to do so.
  - deleted 7y ago
deleted 7y ago
[deleted]

tptacek 7y ago

Obviously, because the alternative is that bugs never get patched, and get independently discovered by people who sell them to brokers instead. If you want to get angry about this, get angry at the vendor that took your money and time and attention and gave you a product with an exploitable security vulnerability in it. I think the issues involved here are a bit subtle to warrant knee-jerk anger, but if you've got to get angry, at least get angry in the right direction.

mehrdadn 7y ago
What? I'm asking about why disclosures happen when patches are provided promptly. I'm not objecting to disclosing when they aren't. How does that "obviously" mean "that bugs never get patched"?
- tptacek 7y ago
  The disclosures motivate the patches. We're not guessing about that; we have a before/after picture of the industry prior to mandatory disclosure windows.
  - mehrdadn 7y ago
    Disclosing when a patch is NOT provided should motivate prompt patches. Nobody is disputing that. But you're saying disclosure when a prompt patch IS provided motivates patches further, and that's not even just a guess? How...?
    - masklinn 7y ago
      > But you're saying disclosure when a prompt patch IS provided motivates patches further, and that's not even just a guess? How…? 1. because the policy is "mandatory disclosure", it's way harder to criticise it if it's a blanket, universal policy 2. disclosure is important for users (in general though mostly corporate) because if the issue is not publicly disclosed they might not update their systems (assuming issues are minor or irrelevant)
      - mehrdadn 7y ago
        > 1. because the policy is "mandatory disclosure", it's way harder to criticise it if it's a blanket, universal policy "It's harder to criticize"? So the reason to put users at risk is to... solve a PR problem? > 2. disclosure is important for users because if the issue is not publicly disclosed they might not update their systems Hold on. You're actively injecting a threat and guaranteeing that everyone knows the exploit immediately and that it can be deployed by lots of people on a wide scale because someone might discover it someday? Can't you just at least easily address this by at least putting a reasonably long time gap between the patch and the disclosure? People will still have to update their systems in the interim due to previous patches' deadlines expiring...
        PKop 7y ago
        Seems like the disconnect between you and others is your assumption there is some time gap of knowledge about the exploit after the patch is released. Others have stated that almost immediately after patches are released they are reverse engineered to discover the exploits. So at that time, motivating people to upgrade to the patch is all benefit no? If they're wrong about their assumptions, you might have a point. If you're wrong, what's the dispute?
        mehrdadn 7y ago
        Yes, but a time gap of knowledge is just one dimension, whereas I see a gap in every other dimension too. I expect that not every bad actor who would learn from a PoC would learn from a binary, not every one who would learn that actually invest the time to write an exploit, not every one who invests the time would actually come up with an exploit in such a short timespan, and not everyone who does all that will target the same set of customers. Furthermore, as I said in another comment, the existence of prior patches would mean people would still have to update regularly because those disclosures would be expiring anyway, so it's not at all clear to me adding a delay would change that. And there are probably other dimensions I can't think of right off the top of my head. There should be an easy way to settle this, which is with data, which I have not yet seen anyone point to. I would be shocked if data showed that the number of actual customer systems hacked actually decreases when a PoC is provided quickly after a patch, vs. when this is not the case.

growse 7y ago

They were at risk before they knew about the vulnerability. The gratitude is for the fact that it now actually gets patched.

mehrdadn 7y ago
For getting the patch, there is gratitude. Why should they feel nicely about the following disclosure though?
- brohee 7y ago
  For all purpose, the patch is disclosure.
- tptacek 7y ago
  This is backwards. The patch is something you're getting from the vendor that put you at risk in the first place.
  - mehrdadn 7y ago
    Instead of telling me I'm being "backwards" about what people should appreciate and what they shouldn't, it'd be more helpful if you could explain your own thoughts like I asked you on the comment above (not here): https://news.ycombinator.com/item?id=20567651 https://news.ycombinator.com/item?id=20567651 I certainly don't follow your logic.
    - deleted 7y ago
      [deleted]
    - deleted 7y ago
      [deleted]
    - tptacek 7y ago
      Why would I do that? None of your arguments on this thread appear to have been persuasive, judging from the pallor the text they're displayed in has taken. If it was just one or two comments, sure, who cares, but you've written a multitude of them, and none of them appear to be surviving. It feels like the burden of proof falls rather more strongly on you than on me at this point.

wolf550e 7y ago

When the vendor provides a patch before the 90 day deadline, do you want P0 to never disclose the bug or to wait a month after patch was released, or what? I think you're complaining that P0 don't give users enough time to patch - e.g. disclosing one day after the patch was released. If so, that is fair and I think they could wait longer, but for things like Microsoft, Apple, Android, Chrome, etc. security patches - those are disassembled and diffed within hours of release, and for some vulnerabilities an exploit is ready within 24h, so P0 disclosing everything so defenders can for example prioritize installing the patches, turn off features/services, etc. is generally a good thing.

mehrdadn 7y ago
I mean, I'm not taking a hard position on what they should do, but I know (a) it shouldn't be immediate, and (b) logically one would think the logic would be "never disclose unless you can provide a compelling reason for doing so". I'm open to hearing a compelling reason, in which case I would think they should disclose after waiting a while, but I need to hear one first.
- sp332 7y ago
  It's disclosed so that the customers know what the vulnerability is. Sometimes patching is not the best thing to do for a given situation. Other mitigations might be possible, or it might not even be an issue depending on how the software is used. Criminal researchers might have found this information anyway, so it's only fair to put the customers on an equal footing.
  - mehrdadn 7y ago
    > Criminal researchers might have found this information anyway, it's only fair to put the customers on an equal footing. Or they might not have, in which case you just gave them a pretty powerful weapon, and it's pretty unfair to customers?? > It's disclosed so that the customers know what the vulnerability is. Sometimes patching is not the best thing to do for a given situation. Other mitigations might be possible, or it might not even be an issue depending on how the software is used. Are you sure "because maybe you shouldn't the patch" is their logic here? (Which doesn't even necessitate this either, but everything I've seen indicates they want you to patch immediately.)

billyhoffman 7y ago

First: everyone is already at risk for everything that P0 finds. The difference is no one if publicly talking about the flaws or the risk in the open. Second: P0 never “immediately places people at risk” because they always follow responsible disclosure. P0 has a well documented and frankly fairly conservative policy before anything is publicly disclosed. Do vendors want more time to fix things? Sure, they always will. Do P0 disclosures sometimes happen publicly before the vendor has things fixed? Yes, Occasionally. However, looking at the net, P0 has provided far more value than they detract with public disclosure of flaws

mehrdadn 7y ago
> First: everyone is already at risk for everything that P0 finds. The difference is no one if publicly talking about the flaws or the risk in the open. You don't see how the risk might increase when more people learn about the vulnerability? > Second: P0 never “immediately places people at risk” because they always follow responsible disclosure. What? They provided proof-of-concept exploits just one week after the patch was provided. That's apparently not "immediate" in the eyes of security researchers, but try asking the average user if that's enough time to expect them to update. > P0 has a well documented and frankly fairly conservative policy before anything is publicly disclosed. Yes, and it could be worse, but it's also not great and could also be better. > Do vendors want more time to fix things? Sure, they always will. That was never my argument. I never said they should get more time to fix things. > Do P0 disclosures sometimes happen publicly before the vendor has things fixed? Yes, Occasionally. Again, I was specifically NOT arguing about disclosing before the patch is provided. > However, looking at the net, P0 has provided far more value than they detract with public disclosure of flaws And I never singled out P0 or claimed otherwise. I'm disputing the entire practice by whomever is practicing it.
- jachee 7y ago
  iOS users tend to be relatively quick about upgrades. Plus, the publication of the announcement contributes to word-of-mouth dissemination of the existence of the vulnerability and prompts those who haven't updated yet to do so.
- deleted 7y ago

deleted 7y ago

[deleted]