5 ms·

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with th

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

RL_Quine 7y ago
That isn't what disclosing these sort of vulnerabilities is about. The core reason for just going full disclosure is that the vendor has absolutely not incentive to fix any sort of bug that is kept private. The customer is impacted, never the vendor.
- ryanlol 7y ago
  Nah, disclosing these vulnerabilities is usually about CV-padding and publicity . There aren’t many people out there hunting bugs just to be nice.
  - cipherboy 7y ago
    I happen to know one of the authors of this post (hey Tom!). He's actually a really nice, down to earth guy. Helped out with our college cyber defense programs and is a killer red teamer. Very patient in explaining how he got in and defaced your website, time and time again. Is this his best work? Nah, this is amateur hour on the part of Netgear. But am I glad it was him who found it? Definitely. Keep in mind, there really wasn't anything _to_ this vulnerability other than copying and pasting from one website (and a firmware zip) to another. They just added a little pretty formating and saved you the trouble of extracting the firmware.
    - ryanlol 7y ago
      I don’t doubt that the authors of this post are wonderful people. I just don’t think that there are too many people in this space working for free, only motivated by a desire to help people. I certainly don’t think that there’s anything wrong with dropping bugs to pad your résumé. To the contrary, I think it’s fundamentally unreasonable to expect that more than a couple of people would do this work for purely selfless reasons.
      - CiPHPerCoder 7y ago
        People who do this kind of work for purely selfless reasons and don't end up starving or homeless are probably very privileged.
JshWright 7y ago
I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?
- CiPHPerCoder 7y ago
  'ryanlol is suggesting that if companies view "full disclosure" as a problem, the solution is (in my words) bribery. I don't think "benefiting the end users" is even present in that equation.
- throw0101a 7y ago
  > How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.
  - JshWright 7y ago
    No one (that I've seen in this thread) disagrees that coordinated disclosure is the best path. If the vendor doesn't want to coordinate, then dumping the vulnerability is the best course available.
  - StavrosK 7y ago
    > And how does dumping the vulnerability without a fix help Netgear owners? It lets us know to buy another brand immediately and never buy Netgear again. > IMHO, the best scenario is coordinated disclosure The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.
    - swiley 7y ago
      Netgear making worthless routers isn’t really news.
- 7y ago
zelon88 7y ago
Let's take that avenue as a thought experiment... 1. Netgear buys the bug. 2. They keep shipping firmware with a private key. 3. Someone with malicious intent finds it. 4. Someone with malicious intent MITMs a Netgear network and does something bad. 5. Bad actor sells bug online. 6. Millions of Netgear devices continue operating with compromised certs. Instead, here's what happened/happens now... 1. Researcher tries to coordinate with the vendor, realizes NDAs are involved and the vendor intends to keep shipping their private key. 2. Researcher dumps details of private key on GH instead. 3. Mozilla and Google stop trusting the cert. 4. Now Netgear no longer gets to decide if they want to fix the problem. Browser vendors have fixed it for them. 5. Millions of otherwise insecure Netgear devices are protected by the browser instead. 6. Netgear rightfully gets bad press and hopefully the shaming makes them rethink their positions on NDAs in their bug-bounty program. 7. Future bug hunters submit bugs straight to a receptive Netgear, who has learned a valuable lesson about being a lazy hack.
- ryanlol 7y ago
  Ah yes, it seems totally reasonable for netgear to not patch bugs they paid for.

RL_Quine 7y ago

That isn't what disclosing these sort of vulnerabilities is about. The core reason for just going full disclosure is that the vendor has absolutely not incentive to fix any sort of bug that is kept private. The customer is impacted, never the vendor.

ryanlol 7y ago
Nah, disclosing these vulnerabilities is usually about CV-padding and publicity . There aren’t many people out there hunting bugs just to be nice.
- cipherboy 7y ago
  I happen to know one of the authors of this post (hey Tom!). He's actually a really nice, down to earth guy. Helped out with our college cyber defense programs and is a killer red teamer. Very patient in explaining how he got in and defaced your website, time and time again. Is this his best work? Nah, this is amateur hour on the part of Netgear. But am I glad it was him who found it? Definitely. Keep in mind, there really wasn't anything _to_ this vulnerability other than copying and pasting from one website (and a firmware zip) to another. They just added a little pretty formating and saved you the trouble of extracting the firmware.
  - ryanlol 7y ago
    I don’t doubt that the authors of this post are wonderful people. I just don’t think that there are too many people in this space working for free, only motivated by a desire to help people. I certainly don’t think that there’s anything wrong with dropping bugs to pad your résumé. To the contrary, I think it’s fundamentally unreasonable to expect that more than a couple of people would do this work for purely selfless reasons.
    - CiPHPerCoder 7y ago
      People who do this kind of work for purely selfless reasons and don't end up starving or homeless are probably very privileged.

JshWright 7y ago

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

CiPHPerCoder 7y ago
'ryanlol is suggesting that if companies view "full disclosure" as a problem, the solution is (in my words) bribery. I don't think "benefiting the end users" is even present in that equation.
throw0101a 7y ago
> How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.
- JshWright 7y ago
  No one (that I've seen in this thread) disagrees that coordinated disclosure is the best path. If the vendor doesn't want to coordinate, then dumping the vulnerability is the best course available.
- StavrosK 7y ago
  > And how does dumping the vulnerability without a fix help Netgear owners? It lets us know to buy another brand immediately and never buy Netgear again. > IMHO, the best scenario is coordinated disclosure The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.
  - swiley 7y ago
    Netgear making worthless routers isn’t really news.
7y ago

zelon88 7y ago

Let's take that avenue as a thought experiment... 1. Netgear buys the bug. 2. They keep shipping firmware with a private key. 3. Someone with malicious intent finds it. 4. Someone with malicious intent MITMs a Netgear network and does something bad. 5. Bad actor sells bug online. 6. Millions of Netgear devices continue operating with compromised certs. Instead, here's what happened/happens now... 1. Researcher tries to coordinate with the vendor, realizes NDAs are involved and the vendor intends to keep shipping their private key. 2. Researcher dumps details of private key on GH instead. 3. Mozilla and Google stop trusting the cert. 4. Now Netgear no longer gets to decide if they want to fix the problem. Browser vendors have fixed it for them. 5. Millions of otherwise insecure Netgear devices are protected by the browser instead. 6. Netgear rightfully gets bad press and hopefully the shaming makes them rethink their positions on NDAs in their bug-bounty program. 7. Future bug hunters submit bugs straight to a receptive Netgear, who has learned a valuable lesson about being a lazy hack.

ryanlol 7y ago
Ah yes, it seems totally reasonable for netgear to not patch bugs they paid for.