4 ms·

> It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. It doesn't seem to me any different than "pro

by gwd 7y ago

> It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself. It doesn't seem to me any different than "pro-life" or "pro-choice"; or "Catholic" (which means "universal") or "Orthodox" (meaning "right-believing"), or "progressive". I know people that won't use "Catholic", but instead will say "Roman" or "Papist" (since that organization is objectively based in Rome, and does follow the Pope); and people who won't use "pro-life", but always say "anti-abortion" or "anti-choice", or who won't use "pro-choice" but use "anti-abortion" instead. I understand where they're coming from and respect their preferences. I myself tend so put "progressive" in quotes, because I don't consider all causes "progressives" pursue to be making progress. But such people normally don't go around injecting themselves into other conversations and complaining about the terms people do use. Rather, they simply engage in the conversation and use their preferred term. I use the word "responsible disclosure" because I think we should be responsible about both how we disclose things and how I keep things secret. Both disclosing immediately, and sitting on an issue for years, are irresponsible in my view. Ideally issues would be reported, fixed, pre-disclosed, and disclosed within a few weeks. Having things fixed in that time frame is not always possible, particularly when you're dealing with a company that is so utterly clueless as the one described here. Given that, whether it's more responsible to zero-day everyone or to sit on it for a year isn't very obvious, and reasonable people can come to different conclusions.

tptacek 7y ago
It turns out I still feel the same way as I did when I woke up at 5AM. I mean, I went back to sleep. But I've been up for a little while now, and I'm pretty sure I'm right, and "responsible disclosure" is way more Orwellian than "pro-life"; there's at least a colorable argument that "pro-life" is descriptive of a policy position, whereas there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms.
- gwd 7y ago
  > there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms. Right, so the reason we disagree is that we have different understandings of what "responsible disclosure" means. From Wikipedia: > In computer security or elsewhere, responsible disclosure is a vulnerability disclosure model in which a vulnerability or an issue is disclosed only after a period of time that allows for the vulnerability or issue to be patched or mended. This period distinguishes the model from full disclosure. [1] And full disclosure: > Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. Nowhere does it say that this is done "on a vendor's schedule and terms". On the contrary, unless there is some other agreement in place, the discoverer can publish any time they like; and so in reality control of the schedule is always at the discoverer's terms. This is recognized in the XenProject's Security Response Process [2]: > When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Google Project Zero typically report a vulnerability and say, "We're telling everyone about this in 90 days, hope you're ready." That is my expectation of "Responsible disclosure". If SEC Consult waited 18 months, it's either because 1) they had a contract with Fortinet of some sort, or 2) they were convinced that waiting 18 months would cause less harm to people than zero-daying everyone. [1] https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure [2] https://xenproject.org/developers/security-policy/ https://xenproject.org/developers/security-policy/
  - tptacek 7y ago
    As I said at the top of the thread: it often makes sense to coordinate with vendors, and natural preferences often do align. But it sometimes doesn't, and, at times, it even makes sense to disclose without any coordination. Un-coordinated disclosure isn't intrinsically irresponsible, and so the term "responsible disclosure" is misleading. This isn't just my idea, and the term itself has become disfavored among vulnerability researchers.
    - gwd 7y ago
      > Un-coordinated disclosure isn't intrinsically irresponsible, I agree with this. > and so the term "responsible disclosure" is misleading. I think this is a key point. As I said, I think "responsible" implies being responsible on both sides: neither simply publishing without sufficient time for a vendor to make a fix, nor waiting indefinitely while the vendor waffles around or tries to pretend the vulnerability doesn't exist. "Responsible disclosure" focuses (or ought to focus) on minimizing harm to users, whereas "coordinated disclosure" focuses on cooperating with the vendor. As such, "Responsible disclosure" in fact carries within itself the threat of going public if the vendor is dragging their feet, where "coordinated disclosure" doesn't. I continue to think that we should use the term "responsible disclosure", and insist that it mean actually behaving responsibly to users. [Minor edits]
      - tptacek 7y ago
        I understand what you're trying to say. You're saying that conceptually there is such a thing as being "responsible" or "irresponsible" about disclosure, and I think that's true! The problem is that (charitably) the term of art (or uncharitably, brand) "responsible disclosure" is attached to some very specific norms, including "not releasing vulnerabilities without a patch" and "giving vendors a commercially reasonable amount of time to create a patch" and "working closely with vendors to coordinate that time window" and "redacting or carefully reducing POC code", which are not themselves universal or even generally "responsible". They're commercially responsible, to be sure! But it should not be an obligation of unpaid third party researchers to expend any effort whatsoever to be responsive to a vendor's commercial concerns. It's a nice thing to do, and some people are just preternaturally nice to vendors, and that's usually fine, but there's nothing deontologically "responsible" about that.

by gwd 7y ago

tptacek 7y ago

It turns out I still feel the same way as I did when I woke up at 5AM. I mean, I went back to sleep. But I've been up for a little while now, and I'm pretty sure I'm right, and "responsible disclosure" is way more Orwellian than "pro-life"; there's at least a colorable argument that "pro-life" is descriptive of a policy position, whereas there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms.

gwd 7y ago
> there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms. Right, so the reason we disagree is that we have different understandings of what "responsible disclosure" means. From Wikipedia: > In computer security or elsewhere, responsible disclosure is a vulnerability disclosure model in which a vulnerability or an issue is disclosed only after a period of time that allows for the vulnerability or issue to be patched or mended. This period distinguishes the model from full disclosure. [1] And full disclosure: > Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. Nowhere does it say that this is done "on a vendor's schedule and terms". On the contrary, unless there is some other agreement in place, the discoverer can publish any time they like; and so in reality control of the schedule is always at the discoverer's terms. This is recognized in the XenProject's Security Response Process [2]: > When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Google Project Zero typically report a vulnerability and say, "We're telling everyone about this in 90 days, hope you're ready." That is my expectation of "Responsible disclosure". If SEC Consult waited 18 months, it's either because 1) they had a contract with Fortinet of some sort, or 2) they were convinced that waiting 18 months would cause less harm to people than zero-daying everyone. [1] https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure [2] https://xenproject.org/developers/security-policy/ https://xenproject.org/developers/security-policy/
- tptacek 7y ago
  As I said at the top of the thread: it often makes sense to coordinate with vendors, and natural preferences often do align. But it sometimes doesn't, and, at times, it even makes sense to disclose without any coordination. Un-coordinated disclosure isn't intrinsically irresponsible, and so the term "responsible disclosure" is misleading. This isn't just my idea, and the term itself has become disfavored among vulnerability researchers.
  - gwd 7y ago
    > Un-coordinated disclosure isn't intrinsically irresponsible, I agree with this. > and so the term "responsible disclosure" is misleading. I think this is a key point. As I said, I think "responsible" implies being responsible on both sides: neither simply publishing without sufficient time for a vendor to make a fix, nor waiting indefinitely while the vendor waffles around or tries to pretend the vulnerability doesn't exist. "Responsible disclosure" focuses (or ought to focus) on minimizing harm to users, whereas "coordinated disclosure" focuses on cooperating with the vendor. As such, "Responsible disclosure" in fact carries within itself the threat of going public if the vendor is dragging their feet, where "coordinated disclosure" doesn't. I continue to think that we should use the term "responsible disclosure", and insist that it mean actually behaving responsibly to users. [Minor edits]
    - tptacek 7y ago
      I understand what you're trying to say. You're saying that conceptually there is such a thing as being "responsible" or "irresponsible" about disclosure, and I think that's true! The problem is that (charitably) the term of art (or uncharitably, brand) "responsible disclosure" is attached to some very specific norms, including "not releasing vulnerabilities without a patch" and "giving vendors a commercially reasonable amount of time to create a patch" and "working closely with vendors to coordinate that time window" and "redacting or carefully reducing POC code", which are not themselves universal or even generally "responsible". They're commercially responsible, to be sure! But it should not be an obligation of unpaid third party researchers to expend any effort whatsoever to be responsive to a vendor's commercial concerns. It's a nice thing to do, and some people are just preternaturally nice to vendors, and that's usually fine, but there's nothing deontologically "responsible" about that.