5 ms·

For the short version, see our branded vulnerability page: https://whosecurve.com https://whosecurve.com

by dguido 7y ago

kortilla 7y ago
Why does a vulnerability need a brand?
- dguido 7y ago
  Do you remember the CVE number of this bug? How about the Citrix bug from last week? It's a poor way to communicate, and there's very strong anecdotal evidence that using a real name promotes patching rates faster than otherwise. Plus, the whosecurve.com website includes the information you want if you only have 10 seconds and it's by the same authors as the blog linked in the OP.
  - JshWright 7y ago
    It has the added "benefit" of making it appear to the casual observer that Trail of Bits found the vulnerability in the first place...
    - tptacek 7y ago
      The fact that their writeups all credit NSA and link to other people's descriptions of the vulnerability has the "benefit" of ensuring that you have to want that misconception in order to end up with it.
- pixl97 7y ago
  So IT can tell the Cxx that yes, this problem is so important to patch that it has a name. Saying we should apply KB123ABC isnt as productive.
oefrha 7y ago
Off topic, but this vulnerability was discovered by the NSA, right? Then you’re not really in the position to brand the vulnerability, or you come off as trying to take credit where credit isn’t due. (I mean, you have every right to make a website for it, but giving it a logo and say “Why even patch if it doesn’t have a logo?” as if it now has an official logo seems to be taking it a bit far.) Please excuse me if I got the origin story wrong. Edit: Also, from the website: > Who’s behind this? > Trail of Bits That could certainly be (mis)interpreted as taking credit for the vulnerability.
- tptacek 7y ago
  You would be misinterpreting them, since their page explicitly credits NSA, cites other people's POCs, and even the HN thread where I wrote down Thomas Pornin's (correct) guess as to what the vulnerability was. The branding thing is a joke, about the fact that neither Microsoft nor NSA branded the vulnerability. Lighten up.
user5994461 7y ago
The test site doesn't specify whether we have to use a specific browser to test the vulnerability? I somehow doubt this affects all desktop browsers IE, Edge, Chrome and Firefox. https://bad.whosecurve.com/ https://bad.whosecurve.com/
- CiPHPerCoder 7y ago
  It affects IE and Edge on Windows 10. It should also affect Chrome on Windows 10 if you haven't updated either your browser or your OS. It won't affect Firefox on either platform.
- drewbitt 7y ago
  Firefox is not effected
- gerdesj 7y ago
  The Trail of Bits CA is unlikely to be in your trust store, so you will always get an error message. For example Chromium on this Linux lappy gives me a certificate error relating to the CA but I can still access the site. After importing the CA to my trust store I can no longer access the site at all because I get a proper fatal error relating to the certificate itself and not the CA. I have problems getting Windows update to work under Arch Linux but I'm hoping to find something in the AUR.
Thorrez 7y ago
There are a number of other brands for it too: CurveBall, NSACrypt, ChainOfFools, and more. None of them have dedicated sites though, so Whose Curve Is It Anyway is obviously the best.

For the short version, see our branded vulnerability page: https://whosecurve.com https://whosecurve.com

by dguido 7y ago

For the short version, see our branded vulnerability page: https://whosecurve.com https://whosecurve.com

kortilla 7y ago

Why does a vulnerability need a brand?

dguido 7y ago
Do you remember the CVE number of this bug? How about the Citrix bug from last week? It's a poor way to communicate, and there's very strong anecdotal evidence that using a real name promotes patching rates faster than otherwise. Plus, the whosecurve.com website includes the information you want if you only have 10 seconds and it's by the same authors as the blog linked in the OP.
- JshWright 7y ago
  It has the added "benefit" of making it appear to the casual observer that Trail of Bits found the vulnerability in the first place...
  - tptacek 7y ago
    The fact that their writeups all credit NSA and link to other people's descriptions of the vulnerability has the "benefit" of ensuring that you have to want that misconception in order to end up with it.
pixl97 7y ago
So IT can tell the Cxx that yes, this problem is so important to patch that it has a name. Saying we should apply KB123ABC isnt as productive.

oefrha 7y ago

Off topic, but this vulnerability was discovered by the NSA, right? Then you’re not really in the position to brand the vulnerability, or you come off as trying to take credit where credit isn’t due. (I mean, you have every right to make a website for it, but giving it a logo and say “Why even patch if it doesn’t have a logo?” as if it now has an official logo seems to be taking it a bit far.) Please excuse me if I got the origin story wrong. Edit: Also, from the website: > Who’s behind this? > Trail of Bits That could certainly be (mis)interpreted as taking credit for the vulnerability.

tptacek 7y ago
You would be misinterpreting them, since their page explicitly credits NSA, cites other people's POCs, and even the HN thread where I wrote down Thomas Pornin's (correct) guess as to what the vulnerability was. The branding thing is a joke, about the fact that neither Microsoft nor NSA branded the vulnerability. Lighten up.

user5994461 7y ago

The test site doesn't specify whether we have to use a specific browser to test the vulnerability? I somehow doubt this affects all desktop browsers IE, Edge, Chrome and Firefox. https://bad.whosecurve.com/ https://bad.whosecurve.com/

CiPHPerCoder 7y ago
It affects IE and Edge on Windows 10. It should also affect Chrome on Windows 10 if you haven't updated either your browser or your OS. It won't affect Firefox on either platform.
drewbitt 7y ago
Firefox is not effected
gerdesj 7y ago
The Trail of Bits CA is unlikely to be in your trust store, so you will always get an error message. For example Chromium on this Linux lappy gives me a certificate error relating to the CA but I can still access the site. After importing the CA to my trust store I can no longer access the site at all because I get a proper fatal error relating to the certificate itself and not the CA. I have problems getting Windows update to work under Arch Linux but I'm hoping to find something in the AUR.

Thorrez 7y ago

There are a number of other brands for it too: CurveBall, NSACrypt, ChainOfFools, and more. None of them have dedicated sites though, so Whose Curve Is It Anyway is obviously the best.