4 ms·

Out of curiosity why would it matter if they "assign you" a CVE? If your intentions were purely altruistic then the CVE matters not. Just make a blog post with

by mox1 6y ago

Out of curiosity why would it matter if they "assign you" a CVE? If your intentions were purely altruistic then the CVE matters not. Just make a blog post with the details and link there. But if perhaps on some level you were after recognition then yes I can see the desire for a CVE...

saagarjha 6y ago
Because I can give people a CVE and they can find it easily rather than "oh it's actually a blog post I wrote, oh you didn't find it by search, here is the link" and absolves me of coming up with a descriptive name, reduces confusion if I ever find another sandbox escape, and centralizes the bug so that future researchers can do things like look up all the bugs for the component or build on it by seeing what's been done in the past. Same reason you might want your book to have an ISBN and show up in a library catalogue, for example.
- saagarjha 6y ago
  A late addition: in the absence of all that, I do fall back on blog posts. I have written one for that bug, of course, but surely you can find it ;)
  - mox1 6y ago
    Again, whats the point of "handing someone a CVE?" Literally just make a post somewhere on the internet and let people see it there. If a CVE shows up, add it to the top. If not, oh well. It should be 100% about getting the right information out there, isn't it? I've spent a lot of time involved in responsible / coordinated disclosure and it's always like this. The person disclosing "just wants to help", but the reality is the vast majority want (or feel entitled to) something for their efforts, be it their name behind a CVE, a bounty, or recognition of some type. Perhaps even the admiration of the company (wow, thanks we are impressed you found that!). That's totally normal and fine, I just wish more people would admit it.
    - saagarjha 6y ago
      As I mentioned, there is a huge amount of value in having a centralized, consistent database of bugs that you can refer to. It's the same thing as naming a new species: ok, sure, it's cool that found it, but by naming it everyone can now call it that and use that name to find it rather than using some ad-hoc non-descriptive name for it. And this is really important for systems like macOS that see multiple bugs in the same component every update: it's important to be able to distinguish them. Getting a CVE number isn't really that difficult, anyways, you can basically get one for anything, like "denial of service" (you found a way to crash an app, congrats). FWIW, Apple should not be impressed I found that, they should be impressed it took someone so long to show them that their sandboxing strategy on macOS is totally broken. It's nice that they wanted to credit me and all, but they fixed the issue in a way that didn't fully resolve the problems that I brought up, which I consider worse than not crediting me or not paying me a bounty.

by mox1 6y ago

saagarjha 6y ago

Because I can give people a CVE and they can find it easily rather than "oh it's actually a blog post I wrote, oh you didn't find it by search, here is the link" and absolves me of coming up with a descriptive name, reduces confusion if I ever find another sandbox escape, and centralizes the bug so that future researchers can do things like look up all the bugs for the component or build on it by seeing what's been done in the past. Same reason you might want your book to have an ISBN and show up in a library catalogue, for example.

saagarjha 6y ago
A late addition: in the absence of all that, I do fall back on blog posts. I have written one for that bug, of course, but surely you can find it ;)
- mox1 6y ago
  Again, whats the point of "handing someone a CVE?" Literally just make a post somewhere on the internet and let people see it there. If a CVE shows up, add it to the top. If not, oh well. It should be 100% about getting the right information out there, isn't it? I've spent a lot of time involved in responsible / coordinated disclosure and it's always like this. The person disclosing "just wants to help", but the reality is the vast majority want (or feel entitled to) something for their efforts, be it their name behind a CVE, a bounty, or recognition of some type. Perhaps even the admiration of the company (wow, thanks we are impressed you found that!). That's totally normal and fine, I just wish more people would admit it.
  - saagarjha 6y ago
    As I mentioned, there is a huge amount of value in having a centralized, consistent database of bugs that you can refer to. It's the same thing as naming a new species: ok, sure, it's cool that found it, but by naming it everyone can now call it that and use that name to find it rather than using some ad-hoc non-descriptive name for it. And this is really important for systems like macOS that see multiple bugs in the same component every update: it's important to be able to distinguish them. Getting a CVE number isn't really that difficult, anyways, you can basically get one for anything, like "denial of service" (you found a way to crash an app, congrats). FWIW, Apple should not be impressed I found that, they should be impressed it took someone so long to show them that their sandboxing strategy on macOS is totally broken. It's nice that they wanted to credit me and all, but they fixed the issue in a way that didn't fully resolve the problems that I brought up, which I consider worse than not crediting me or not paying me a bounty.