12 ms·

It's only a donation if you assume the vulnerability is not cutting edge, otherwise it doesn't seem unfair to label the disclosure as corrosive to the current z

It's only a donation if you assume the vulnerability is not cutting edge, otherwise it doesn't seem unfair to label the disclosure as corrosive to the current zeitgeist in terms of user safety. Just because you've managed to marry genuine research and politics doesn't mean that you've eliminated the more general bias produced by researching/disclosing information about opposing products more frequently than your own. At the same time, this also doesn't mean the system is bad, it could be entirely possible that the status quo of security without adversarial research is much worse for the end user.

tptacek 7y ago
I don't know what any of this means. The vulnerabilities exist no matter who discovers them, and vulnerability discovery is a service every major vendor pays dearly for. If the optics of discovery are bad for Apple or Microsoft, Apple or Microsoft should spend more to keep from being one-upped by P0.
- 2804t3qwp 7y ago
  From what you've said it seems like the difference is more an issue of framing. You're focused on the effects for the end user, which are the same no matter what in my opinion and I agree on that. At the same time, if you're publishing exploits that are cutting edge and primarily only apply to the competition then, because you (in this hypothetical) are a company, the overall effects of the research are self serving. Why not publish more vulnerabilities that apply to your own systems otherwise? Surely you (again, the hypothetical you) are in a better position than other entities to engage in introspective research that benefits the end user. Obviously there's a possibility that the explanation is "Because the competition has more flaws than our/my own product" but without evidence such is the case then there isn't a lot of reason for outside critics to give the benefit of the doubt. Also, I'm not a security researcher so I realize some of my points might not be accurate to the state of the industry. I'm moreso trying to highlight the lines of thinking that lead to criticism of P0 and why I don't think they're easy to refute without a certain degree of burden on Google's/Totallyrelatedbutnot-google's part.
  - tptacek 7y ago
    I don't understand really any of this. Finding vulnerabilities in your competitors products is in fact a donation to those competitors and, more importantly, their users.
    - 2804t3qwp 7y ago
      It sounds like the idea that it's a donation is the part where we fundamentally disagree then. If you expose an unpatched exploit and the number of people using that exploit goes up because of your publication then you've contributed to worsening the security landscape for whoever the relevant user is. If an exploit is years old, or if there's some other relevant context, then sure exposing a vulnerability mainly means that the parent company doesn't have to pay for the research. But it's not a favor they asked you to perform and if you have a competing product with that company then the question becomes "Why aren't you publishing more about yourself?" since surely no one is in a better position to do security research on your products than yourself or a contractor you hired. It's basically PR motivated research and when there's also a lack of transparency it leads to easy speculation that maybe you're holding back research on yourself purposefully or even simply not publishing the more damning research you discover about your own products.
      - tptacek 7y ago
        There's no "agreement" or "disagreement" to be had here. Vulnerability researchers don't create vulnerabilities, they find and ultimately eliminate them. Vulnerability research at the level practiced by P0 commands huge daily rates, and Google's competitors actively pay those rates to other researchers. It is simply a fact that what Google is doing is a donation to other vendors and their users. You can dispute their intentions, but I'm not all that interested in debating those. What you can't do is debate the effect, which is positive.
        2804t3qwp 7y ago
        If you're not interested in debating their intentions then why frame it as a donation? That by itself is a normative judgement in this context, and the reason I brought up framing, since normally two primary characteristics of a donation are that it can be refused and that it is being offered in good faith. This is the same general point that the original comment you had replied to was making which itself was an explanation of why people are distrustful of P0 even if the brass tax is positive for the end user. It's fine if you don't find that political side of it interesting but it's not as simple as just being a donation.

tptacek 7y ago

I don't know what any of this means. The vulnerabilities exist no matter who discovers them, and vulnerability discovery is a service every major vendor pays dearly for. If the optics of discovery are bad for Apple or Microsoft, Apple or Microsoft should spend more to keep from being one-upped by P0.

2804t3qwp 7y ago
From what you've said it seems like the difference is more an issue of framing. You're focused on the effects for the end user, which are the same no matter what in my opinion and I agree on that. At the same time, if you're publishing exploits that are cutting edge and primarily only apply to the competition then, because you (in this hypothetical) are a company, the overall effects of the research are self serving. Why not publish more vulnerabilities that apply to your own systems otherwise? Surely you (again, the hypothetical you) are in a better position than other entities to engage in introspective research that benefits the end user. Obviously there's a possibility that the explanation is "Because the competition has more flaws than our/my own product" but without evidence such is the case then there isn't a lot of reason for outside critics to give the benefit of the doubt. Also, I'm not a security researcher so I realize some of my points might not be accurate to the state of the industry. I'm moreso trying to highlight the lines of thinking that lead to criticism of P0 and why I don't think they're easy to refute without a certain degree of burden on Google's/Totallyrelatedbutnot-google's part.
- tptacek 7y ago
  I don't understand really any of this. Finding vulnerabilities in your competitors products is in fact a donation to those competitors and, more importantly, their users.
  - 2804t3qwp 7y ago
    It sounds like the idea that it's a donation is the part where we fundamentally disagree then. If you expose an unpatched exploit and the number of people using that exploit goes up because of your publication then you've contributed to worsening the security landscape for whoever the relevant user is. If an exploit is years old, or if there's some other relevant context, then sure exposing a vulnerability mainly means that the parent company doesn't have to pay for the research. But it's not a favor they asked you to perform and if you have a competing product with that company then the question becomes "Why aren't you publishing more about yourself?" since surely no one is in a better position to do security research on your products than yourself or a contractor you hired. It's basically PR motivated research and when there's also a lack of transparency it leads to easy speculation that maybe you're holding back research on yourself purposefully or even simply not publishing the more damning research you discover about your own products.
    - tptacek 7y ago
      There's no "agreement" or "disagreement" to be had here. Vulnerability researchers don't create vulnerabilities, they find and ultimately eliminate them. Vulnerability research at the level practiced by P0 commands huge daily rates, and Google's competitors actively pay those rates to other researchers. It is simply a fact that what Google is doing is a donation to other vendors and their users. You can dispute their intentions, but I'm not all that interested in debating those. What you can't do is debate the effect, which is positive.
      - 2804t3qwp 7y ago
        If you're not interested in debating their intentions then why frame it as a donation? That by itself is a normative judgement in this context, and the reason I brought up framing, since normally two primary characteristics of a donation are that it can be refused and that it is being offered in good faith. This is the same general point that the original comment you had replied to was making which itself was an explanation of why people are distrustful of P0 even if the brass tax is positive for the end user. It's fine if you don't find that political side of it interesting but it's not as simple as just being a donation.