3 ms·

You should dig in to the history of “responsible disclosure”. http://attrition.org/security/rant/z/ms-disclose.html http://attrition.org/security/rant/z/ms-dis

You should dig in to the history of “responsible disclosure”. http://attrition.org/security/rant/z/ms-disclose.html http://attrition.org/security/rant/z/ms-disclose.html It’s a dumb term. You should never use it. Use a more descriptive and neutral term.

gwd 7y ago
> You should dig in to the history of “responsible disclosure”. That doesn't give a history of responsible disclosure, but it does correspond with my understanding of the situation. He mentions "RFPolicy" invented by security researcher Rain Forest Puppy [1]. This policy includes the following stipulation right at the top: > You basically have 5 days (read below for the definitions and semantics of what is considered a 'day') to return contact to the individual, and must keep in contact with them at least every 5 days. Failure to do so will discourage them from working with you and encourage them to publicly disclose the security problem. This is completely the opposite of "the vendor is entirely in control of the process". A few paragraphs after this reference, the author of your article says: > This entire charade [a push by Microsoft about disclosure] is nothing more than an elaborate PR scam. The five security companies that are involved (@Stake, BindView, ISS, Foundstone, Guardent), were they not following these general rules along the lines of responsible disclosure? This paragraph implies that the author of the article identifes RFPolicy -- a policy created by security researchers themselves -- with "responsible disclosure", and is blaming Microsoft for trying to hijack the term. But instead of insisting that "responsible disclosure" means something like RFPolicy, you're insisting that actually "responsible disclosure" means something like what Microsoft wants it to mean. Rather than fighting to maintain control a term that security researchers invented, you're advocating surrendering the term to Microsoft and other organizations like them. I think that's bad strategy. [1] https://dl.packetstormsecurity.net/papers/general/rfpolicy-2.0.txt https://dl.packetstormsecurity.net/papers/general/rfpolicy-2... Edit: Clarify some antecedents.
- lawnchair_larry 7y ago
  There is a lot of history here that you may not be aware of. Security researchers didn’t invent it, that’s kind of the point. Microsoft did, to further their own interests, in a way that was very adversarial to security researchers, and one of their vendors at the time (@Stake) tried to formalize it in an RFC that went nowhere. And the primary author of that RFC, who was an @stake employee (Wysopal), has also publicly disavowed it. This isn’t surrendering the term, not only because Microsoft largely invented it, but even they disavowed it 10 years ago. Not even Microsoft wants that term anymore! You cannot “insist” what it means. You’re trying to redefine it from it’s original framework to fit your personal definition of “responsible”, which nobody agrees on, and which is one of the many reasons that it’s a dumb term. It’s like saying you believe in buying cars that are responsible colors. If you want to communicate efficiently and without being inflammatory and presumptuous in a community where reasonable minds have long disagreed, you should just say “red”. Everyone knows what that means. Here is some other reading: https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor... https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf https://resources.sei.cmu.edu/asset_files/SpecialReport/2017... (See 1.2.5.1) https://www.computerworld.com/article/2519499/drop--responsible--from-bug-disclosures--microsoft-urges.html https://www.computerworld.com/article/2519499/drop--responsi... https://security.googleblog.com/2010/07/rebooting-responsible-disclosure-focus.html?m=1 https://security.googleblog.com/2010/07/rebooting-responsibl...

gwd 7y ago

> You should dig in to the history of “responsible disclosure”. That doesn't give a history of responsible disclosure, but it does correspond with my understanding of the situation. He mentions "RFPolicy" invented by security researcher Rain Forest Puppy [1]. This policy includes the following stipulation right at the top: > You basically have 5 days (read below for the definitions and semantics of what is considered a 'day') to return contact to the individual, and must keep in contact with them at least every 5 days. Failure to do so will discourage them from working with you and encourage them to publicly disclose the security problem. This is completely the opposite of "the vendor is entirely in control of the process". A few paragraphs after this reference, the author of your article says: > This entire charade [a push by Microsoft about disclosure] is nothing more than an elaborate PR scam. The five security companies that are involved (@Stake, BindView, ISS, Foundstone, Guardent), were they not following these general rules along the lines of responsible disclosure? This paragraph implies that the author of the article identifes RFPolicy -- a policy created by security researchers themselves -- with "responsible disclosure", and is blaming Microsoft for trying to hijack the term. But instead of insisting that "responsible disclosure" means something like RFPolicy, you're insisting that actually "responsible disclosure" means something like what Microsoft wants it to mean. Rather than fighting to maintain control a term that security researchers invented, you're advocating surrendering the term to Microsoft and other organizations like them. I think that's bad strategy. [1] https://dl.packetstormsecurity.net/papers/general/rfpolicy-2.0.txt https://dl.packetstormsecurity.net/papers/general/rfpolicy-2... Edit: Clarify some antecedents.

lawnchair_larry 7y ago
There is a lot of history here that you may not be aware of. Security researchers didn’t invent it, that’s kind of the point. Microsoft did, to further their own interests, in a way that was very adversarial to security researchers, and one of their vendors at the time (@Stake) tried to formalize it in an RFC that went nowhere. And the primary author of that RFC, who was an @stake employee (Wysopal), has also publicly disavowed it. This isn’t surrendering the term, not only because Microsoft largely invented it, but even they disavowed it 10 years ago. Not even Microsoft wants that term anymore! You cannot “insist” what it means. You’re trying to redefine it from it’s original framework to fit your personal definition of “responsible”, which nobody agrees on, and which is one of the many reasons that it’s a dumb term. It’s like saying you believe in buying cars that are responsible colors. If you want to communicate efficiently and without being inflammatory and presumptuous in a community where reasonable minds have long disagreed, you should just say “red”. Everyone knows what that means. Here is some other reading: https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor... https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf https://resources.sei.cmu.edu/asset_files/SpecialReport/2017... (See 1.2.5.1) https://www.computerworld.com/article/2519499/drop--responsible--from-bug-disclosures--microsoft-urges.html https://www.computerworld.com/article/2519499/drop--responsi... https://security.googleblog.com/2010/07/rebooting-responsible-disclosure-focus.html?m=1 https://security.googleblog.com/2010/07/rebooting-responsibl...