8 ms·

Does responsible disclosure really make sense for design flaws like this? Any motivated attacker would have already noticed it too you'd think.

• steven_is_false 7y ago
  I'm not sure "Responsible Disclosure" makes sense in any case.
  • kortilla 7y ago
    It does if you’re ethical and care about potential fallout.
    • bigiain 7y ago
      "Potential fallout"??? Like the potential fallout of known broken "encryption" in a security vendors products being hidden from their customers for 18 months? The ethics of publicly disclosing way quicker than that, despite what the vendor wants to label "responsible disclosure", seems pretty straightforward to me... I hope that 18 months of conference calls was extremely lucrative for the researcher here, because I'd feel like a jerk sitting on that one for a year and a half while the vendor was no doubt selling more and more of their broken and insecure crap to unsuspecting customers...
      • lawnchair_larry 7y ago
        And this right here is why “responsible disclosure” is a dumb term that people need to stop using. Look how much time is wasted arguing over the highly subjective definition of “responsible” that breaks out. Communicating these issues would be far more optimal if we use objective language. That was the point when Scott Culp coined that awful term in the first place. People are still taking the bait.
  • tfha 7y ago
    Acting responsibly as a researcher who has discovered a vulnerability requires delicately balancing a question of two greater evils. Will more people get hurt overall if we announce the vulnerability sooner, or will more people get hurt overall if we wait until the vendor is ready? In most cases, working with the vendor to allow a patch and a warning to be released is the path of least harm. But sometimes the right decision is to announce a vulnerability before the vendor has issued a patch.
• yoloClin 7y ago
  > Any motivated attacker would have already noticed it too you'd think. Motivated is a keyword here. Opportunistic attacks occur, and probably make up for the majority of such attacks.
  • mkj 7y ago
    An attacker would be beyond opportunistic if they're already monitoring upstream traffic in this case?
    • yoloClin 7y ago
      The intended definition of opportunistic is not knowing about the vulnerability, but otherwise capable of exploiting it.
• tptacek 7y ago
  "Responsible disclosure" is an Orwellian term coined to coerce researchers into aligning their actions with the incentives of vendors. The better term is "coordinated disclosure", and coordination sometimes does make sense, and other times does not.
  • jcims 7y ago
    Bug bounties are the real chilling force here, not the terminology used to describe a disclosure protocol. From what I recall before then there was a full spectrum of behavior, some would let the vendor steer the disclosure, some would set a timeline and stick to it, and some would hang the scalp as soon as they could. I don't know that I personally ever witnessed any major fallout from the release of a zero day. Seemed like more of a speculative risk than anything. Plenty of shaming to go around though.
  • gwd 7y ago
    "Responsible disclosure" is an opinionated term, and there's nothing wrong with people using it if they think that what they're doing is actually responsible. In fact, one advantage of using it is that it should, in theory, make one thing about whether the coordination you're doing is responsible or not. I was at first inclined to think that a year and a half was way too long to actually be considered "responsible". But if the outcome of that process was that FortiNet now has actual encryption in place (as one would hope since the advisory recommends people update their software, instead of recommending switching to a competing product), then I think there's an argument to be made that the effort put in will probably have been beneficial on the whole.
    • tptacek 7y ago
      The term was literally coined by a group of vendors, and uses the word "responsible" so as to launder their commercial preferences into a universal norm. It worked so seamlessly that people casually use the brand without even thinking about where it came from or what it implies; it's like the word "kleenex" but with malign moral freight. It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. On the other hand it's 5 in the morning and I've been awake for 4 minutes so it's possible that when I'm fully conscious I'll feel differently.