3 ms·

"Responsible disclosure" is an opinionated term, and there's nothing wrong with people using it if they think that what they're doing is actually responsible.

by gwd 7y ago

"Responsible disclosure" is an opinionated term, and there's nothing wrong with people using it if they think that what they're doing is actually responsible. In fact, one advantage of using it is that it should, in theory, make one thing about whether the coordination you're doing is responsible or not. I was at first inclined to think that a year and a half was way too long to actually be considered "responsible". But if the outcome of that process was that FortiNet now has actual encryption in place (as one would hope since the advisory recommends people update their software, instead of recommending switching to a competing product), then I think there's an argument to be made that the effort put in will probably have been beneficial on the whole.

tptacek 7y ago
The term was literally coined by a group of vendors, and uses the word "responsible" so as to launder their commercial preferences into a universal norm. It worked so seamlessly that people casually use the brand without even thinking about where it came from or what it implies; it's like the word "kleenex" but with malign moral freight. It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. On the other hand it's 5 in the morning and I've been awake for 4 minutes so it's possible that when I'm fully conscious I'll feel differently.
- gwd 7y ago
  > It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. It doesn't seem to me any different than "pro-life" or "pro-choice"; or "Catholic" (which means "universal") or "Orthodox" (meaning "right-believing"), or "progressive". I know people that won't use "Catholic", but instead will say "Roman" or "Papist" (since that organization is objectively based in Rome, and does follow the Pope); and people who won't use "pro-life", but always say "anti-abortion" or "anti-choice", or who won't use "pro-choice" but use "anti-abortion" instead. I understand where they're coming from and respect their preferences. I myself tend so put "progressive" in quotes, because I don't consider all causes "progressives" pursue to be making progress. But such people normally don't go around injecting themselves into other conversations and complaining about the terms people do use. Rather, they simply engage in the conversation and use their preferred term. I use the word "responsible disclosure" because I think we should be responsible about both how we disclose things and how I keep things secret. Both disclosing immediately, and sitting on an issue for years, are irresponsible in my view. Ideally issues would be reported, fixed, pre-disclosed, and disclosed within a few weeks. Having things fixed in that time frame is not always possible, particularly when you're dealing with a company that is so utterly clueless as the one described here. Given that, whether it's more responsible to zero-day everyone or to sit on it for a year isn't very obvious, and reasonable people can come to different conclusions.
  - tptacek 7y ago
    It turns out I still feel the same way as I did when I woke up at 5AM. I mean, I went back to sleep. But I've been up for a little while now, and I'm pretty sure I'm right, and "responsible disclosure" is way more Orwellian than "pro-life"; there's at least a colorable argument that "pro-life" is descriptive of a policy position, whereas there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms.
    - gwd 7y ago
      > there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms. Right, so the reason we disagree is that we have different understandings of what "responsible disclosure" means. From Wikipedia: > In computer security or elsewhere, responsible disclosure is a vulnerability disclosure model in which a vulnerability or an issue is disclosed only after a period of time that allows for the vulnerability or issue to be patched or mended. This period distinguishes the model from full disclosure. [1] And full disclosure: > Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. Nowhere does it say that this is done "on a vendor's schedule and terms". On the contrary, unless there is some other agreement in place, the discoverer can publish any time they like; and so in reality control of the schedule is always at the discoverer's terms. This is recognized in the XenProject's Security Response Process [2]: > When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Google Project Zero typically report a vulnerability and say, "We're telling everyone about this in 90 days, hope you're ready." That is my expectation of "Responsible disclosure". If SEC Consult waited 18 months, it's either because 1) they had a contract with Fortinet of some sort, or 2) they were convinced that waiting 18 months would cause less harm to people than zero-daying everyone. [1] https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure [2] https://xenproject.org/developers/security-policy/ https://xenproject.org/developers/security-policy/
tialaramex 7y ago
Much like a "due process" standard so-called "responsible disclosure" is only anything like responsible if you have set out how you'll be responsible in advance and then stuck to those rules. If reality argues in favour of changing your methods so as to be "more responsible" whether that means disclosing sooner, or later, to different parties or in a different way, that should be a _separate_ process which changes future policy. Google's Project Zero is an example - regardless of whether they're finding holes in Android or iOS, it's the same policies, Google's Android team needs an extra week? Same result as when Apple's iOS team asks for one. If you don't have the policy set down in advance, you're vulnerable to manipulation which will invariably be a bad idea as well as leaving you looking _less_ responsible than you intended. The outcome is that bad guys had _over a year_ extra to read everything FortiGuard products were doing without customers having any awareness this was happening.

by gwd 7y ago

tptacek 7y ago

The term was literally coined by a group of vendors, and uses the word "responsible" so as to launder their commercial preferences into a universal norm. It worked so seamlessly that people casually use the brand without even thinking about where it came from or what it implies; it's like the word "kleenex" but with malign moral freight. It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. On the other hand it's 5 in the morning and I've been awake for 4 minutes so it's possible that when I'm fully conscious I'll feel differently.

gwd 7y ago
> It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. It doesn't seem to me any different than "pro-life" or "pro-choice"; or "Catholic" (which means "universal") or "Orthodox" (meaning "right-believing"), or "progressive". I know people that won't use "Catholic", but instead will say "Roman" or "Papist" (since that organization is objectively based in Rome, and does follow the Pope); and people who won't use "pro-life", but always say "anti-abortion" or "anti-choice", or who won't use "pro-choice" but use "anti-abortion" instead. I understand where they're coming from and respect their preferences. I myself tend so put "progressive" in quotes, because I don't consider all causes "progressives" pursue to be making progress. But such people normally don't go around injecting themselves into other conversations and complaining about the terms people do use. Rather, they simply engage in the conversation and use their preferred term. I use the word "responsible disclosure" because I think we should be responsible about both how we disclose things and how I keep things secret. Both disclosing immediately, and sitting on an issue for years, are irresponsible in my view. Ideally issues would be reported, fixed, pre-disclosed, and disclosed within a few weeks. Having things fixed in that time frame is not always possible, particularly when you're dealing with a company that is so utterly clueless as the one described here. Given that, whether it's more responsible to zero-day everyone or to sit on it for a year isn't very obvious, and reasonable people can come to different conclusions.
- tptacek 7y ago
  It turns out I still feel the same way as I did when I woke up at 5AM. I mean, I went back to sleep. But I've been up for a little while now, and I'm pretty sure I'm right, and "responsible disclosure" is way more Orwellian than "pro-life"; there's at least a colorable argument that "pro-life" is descriptive of a policy position, whereas there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms.
  - gwd 7y ago
    > there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms. Right, so the reason we disagree is that we have different understandings of what "responsible disclosure" means. From Wikipedia: > In computer security or elsewhere, responsible disclosure is a vulnerability disclosure model in which a vulnerability or an issue is disclosed only after a period of time that allows for the vulnerability or issue to be patched or mended. This period distinguishes the model from full disclosure. [1] And full disclosure: > Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. Nowhere does it say that this is done "on a vendor's schedule and terms". On the contrary, unless there is some other agreement in place, the discoverer can publish any time they like; and so in reality control of the schedule is always at the discoverer's terms. This is recognized in the XenProject's Security Response Process [2]: > When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Google Project Zero typically report a vulnerability and say, "We're telling everyone about this in 90 days, hope you're ready." That is my expectation of "Responsible disclosure". If SEC Consult waited 18 months, it's either because 1) they had a contract with Fortinet of some sort, or 2) they were convinced that waiting 18 months would cause less harm to people than zero-daying everyone. [1] https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure [2] https://xenproject.org/developers/security-policy/ https://xenproject.org/developers/security-policy/

tialaramex 7y ago

Much like a "due process" standard so-called "responsible disclosure" is only anything like responsible if you have set out how you'll be responsible in advance and then stuck to those rules. If reality argues in favour of changing your methods so as to be "more responsible" whether that means disclosing sooner, or later, to different parties or in a different way, that should be a _separate_ process which changes future policy. Google's Project Zero is an example - regardless of whether they're finding holes in Android or iOS, it's the same policies, Google's Android team needs an extra week? Same result as when Apple's iOS team asks for one. If you don't have the policy set down in advance, you're vulnerable to manipulation which will invariably be a bad idea as well as leaving you looking _less_ responsible than you intended. The outcome is that bad guys had _over a year_ extra to read everything FortiGuard products were doing without customers having any awareness this was happening.