3 ms·

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

CiPHPerCoder 7y ago
'ryanlol is suggesting that if companies view "full disclosure" as a problem, the solution is (in my words) bribery. I don't think "benefiting the end users" is even present in that equation.
throw0101a 7y ago
> How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.
- JshWright 7y ago
  No one (that I've seen in this thread) disagrees that coordinated disclosure is the best path. If the vendor doesn't want to coordinate, then dumping the vulnerability is the best course available.
- StavrosK 7y ago
  > And how does dumping the vulnerability without a fix help Netgear owners? It lets us know to buy another brand immediately and never buy Netgear again. > IMHO, the best scenario is coordinated disclosure The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.
  - swiley 7y ago
    Netgear making worthless routers isn’t really news.
ryanlol 7y ago
I have zero sympathy for end users who aren’t willing to hold the vendors accountable. And besides, there’s nothing stopping the millions of end users from offering their own bribes in order to get shit fixed. $10 from each would go very far.
- tracker1 7y ago
  They already gave their "bribes" to get it fixed, by buying a product and expecting a reasonable level of support. Personally, I haven't liked most Netgear hardware I've tried... but since the FCC cracked down on open firmware for consumer gear, options are really limited with most vendors.
  - ryanlol 7y ago
    > They already gave their "bribes" to get it fixed, by buying a product and expecting a reasonable level of support Ah yes, that certainly sufficiently compensates independent security research. Your complaints aren’t worth shit unless you’re willing to pay up.

CiPHPerCoder 7y ago

'ryanlol is suggesting that if companies view "full disclosure" as a problem, the solution is (in my words) bribery. I don't think "benefiting the end users" is even present in that equation.

throw0101a 7y ago

> How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.

JshWright 7y ago
No one (that I've seen in this thread) disagrees that coordinated disclosure is the best path. If the vendor doesn't want to coordinate, then dumping the vulnerability is the best course available.
StavrosK 7y ago
> And how does dumping the vulnerability without a fix help Netgear owners? It lets us know to buy another brand immediately and never buy Netgear again. > IMHO, the best scenario is coordinated disclosure The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.
- swiley 7y ago
  Netgear making worthless routers isn’t really news.

ryanlol 7y ago

I have zero sympathy for end users who aren’t willing to hold the vendors accountable. And besides, there’s nothing stopping the millions of end users from offering their own bribes in order to get shit fixed. $10 from each would go very far.

tracker1 7y ago
They already gave their "bribes" to get it fixed, by buying a product and expecting a reasonable level of support. Personally, I haven't liked most Netgear hardware I've tried... but since the FCC cracked down on open firmware for consumer gear, options are really limited with most vendors.
- ryanlol 7y ago
  > They already gave their "bribes" to get it fixed, by buying a product and expecting a reasonable level of support Ah yes, that certainly sufficiently compensates independent security research. Your complaints aren’t worth shit unless you’re willing to pay up.