3 ms·

> The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is

> The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is not. What? Have you even tried to understand what responsible disclosure is? It is about giving the vendor a chance to protect their consumers before teaching the public how to exploit a vulnerability. The vendor still gets put on blast when the vulnerability is eventually disclosed. But at least there is less risk of the vulnerability being exploited in the mean time. And if the vendor doesn't fix the vulnerability in a reasonable time frame, they get extra blast. We've seen this happen many times. The recent Valve and Intel incidents stand out to me as good examples.

sneak 7y ago
The vendor’s existence and actions are irrelevant to whether or not it’s okay to publish your research at any time. It is never irresponsible to disclose one’s research in public, in full. Vendors don’t factor in to it at all.
- HereBeBeasties 7y ago
  Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.
  - sneak 7y ago
    The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.
    - CivBase 7y ago
      > The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. Burden of proof? This isn't a court case. The overwhelming majority of users will never see a vulnerability write-up, do not have the education needed to understand such a writeup and - even if they saw the writeup and understood it - lack the tools and information to fix a vulnerability in proprietary software. The vendor only factors in because they are the only one who can fix the issue. A disclosure like this only helps hackers and the few consumers who are capable of hacking their own product. It hurts everyone else. > The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is. Who here is arguing against disclosure? We're arguing for responsible disclosure. Once the vendor distributes patch, consumers can actually do something to protect themselves. At that point, you can put the vendor on blast all you want without harming the consumers.

sneak 7y ago

The vendor’s existence and actions are irrelevant to whether or not it’s okay to publish your research at any time. It is never irresponsible to disclose one’s research in public, in full. Vendors don’t factor in to it at all.

HereBeBeasties 7y ago
Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.
- sneak 7y ago
  The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.
  - CivBase 7y ago
    > The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. Burden of proof? This isn't a court case. The overwhelming majority of users will never see a vulnerability write-up, do not have the education needed to understand such a writeup and - even if they saw the writeup and understood it - lack the tools and information to fix a vulnerability in proprietary software. The vendor only factors in because they are the only one who can fix the issue. A disclosure like this only helps hackers and the few consumers who are capable of hacking their own product. It hurts everyone else. > The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is. Who here is arguing against disclosure? We're arguing for responsible disclosure. Once the vendor distributes patch, consumers can actually do something to protect themselves. At that point, you can put the vendor on blast all you want without harming the consumers.