3 ms·

Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the sol

Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.

sneak 7y ago
The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.
- CivBase 7y ago
  > The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. Burden of proof? This isn't a court case. The overwhelming majority of users will never see a vulnerability write-up, do not have the education needed to understand such a writeup and - even if they saw the writeup and understood it - lack the tools and information to fix a vulnerability in proprietary software. The vendor only factors in because they are the only one who can fix the issue. A disclosure like this only helps hackers and the few consumers who are capable of hacking their own product. It hurts everyone else. > The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is. Who here is arguing against disclosure? We're arguing for responsible disclosure. Once the vendor distributes patch, consumers can actually do something to protect themselves. At that point, you can put the vendor on blast all you want without harming the consumers.

sneak 7y ago

The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.

CivBase 7y ago
> The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. Burden of proof? This isn't a court case. The overwhelming majority of users will never see a vulnerability write-up, do not have the education needed to understand such a writeup and - even if they saw the writeup and understood it - lack the tools and information to fix a vulnerability in proprietary software. The vendor only factors in because they are the only one who can fix the issue. A disclosure like this only helps hackers and the few consumers who are capable of hacking their own product. It hurts everyone else. > The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is. Who here is arguing against disclosure? We're arguing for responsible disclosure. Once the vendor distributes patch, consumers can actually do something to protect themselves. At that point, you can put the vendor on blast all you want without harming the consumers.