4 ms·

We need to pass laws that forbid retaliation against disclosure, and require bounty programs. It might even make sense to have disclosure go through a public ag

We need to pass laws that forbid retaliation against disclosure, and require bounty programs. It might even make sense to have disclosure go through a public agency to arbitrate, and bond companies to that agency, much like we do with contractors.

ic4l 6y ago
I agree, especially with risky parties like banks, or government institutions. It's always a scary experience. The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports. Since then they did develop a disclosure program, but it would be great to hear from anyone else that reported things to them after the end of 2017.
- tyingq 6y ago
  "The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports." Probably because there's no obvious way to submit one.
  - ic4l 6y ago
    They had one a few months after https://responsibledisclosure.jpmorganchase.com/hc/en-us https://responsibledisclosure.jpmorganchase.com/hc/en-us
    - Defenestresque 6y ago
      >All attack payload data must use professional language Huh.
      - aidenn0 6y ago
        They probably want to check PoC into their repository and banks take a very dim view on unprofessional language in the DB. I would only be slightly surprised had the terms included: "All code must be written while wearing professional attire"
swiley 6y ago
I'm tempted to agree with you but I would be surprised if a law like that didn't make the situation worse.
- ceejayoz 6y ago
  The "we can't possibly write good laws" attitude is, IMO, a significant part of why we don't write good laws in the US.
  - pmichaud 6y ago
    You may be right, but I suspect the causality is reversed: maybe there's a widespread sense that good laws cannot be written because, empirically, the people who make laws do so in devastatingly dumb ways. Whatever issue will immediately become a political football, and will end up being not only ineffective at the initial intention, but also include terrible side effects and dangerous footguns. Whether this is the result of a basically broken system of legislature, or of allowing the laws be drafted by the people they are supposed to protect against, or a combination of both, or something else entirely, I'm not qualified to say. But I can say this: when I hear of some political ambition to make something better with a new law, I don't expect it to go well.
    - jjoonathan 6y ago
      When I hear of some political ambition to make something better through inaction or through demolishing Chesterton's Fence, I don't expect it to go well.
  - ashtonian 6y ago
    It's also a product if writing good laws is really hard because the people writing them are outside the industry, different from the people enforcing them, and often different from the people it affects. Better to remove barriers and things that silo and centralize power.
    - hnick 6y ago
chenpengcheng 6y ago
that is not going to happen in the US.
- Schiendelman 6y ago
  It only has to happen in a couple of states that do have a great track record for passing laws like that.
whiskeykilo 6y ago
It's slow going but we'll get there eventually. NIST made a recent revision to SP 800-53 that includes responsible disclosure as a recommendation: https://csrc.nist.gov/publications/detail/sp/800-53b/final https://csrc.nist.gov/publications/detail/sp/800-53b/final
- Schiendelman 6y ago
  Thanks very much, I hadn’t seen this and it’s good news!
franga2000 6y ago
Since the people in charge are basically the same rich morons as (or in the pocket of) the ones doing this to researchers, I wouldn't hold my breath. Best we can hope for is that the EU or some other trigger-happy regulators do the same for security as they tried to do for privacy: mandate a dedicated security contact that legally has to respond to your disclosure. Then at least we'll have some form of direct contact and not have to resort to twitter for "secure" disclosure.
- Schiendelman 6y ago
  There are a few states, notably California, that are just as good as the EU at drafting this kind of legislation.

ic4l 6y ago

I agree, especially with risky parties like banks, or government institutions. It's always a scary experience. The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports. Since then they did develop a disclosure program, but it would be great to hear from anyone else that reported things to them after the end of 2017.

tyingq 6y ago
"The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports." Probably because there's no obvious way to submit one.
- ic4l 6y ago
  They had one a few months after https://responsibledisclosure.jpmorganchase.com/hc/en-us https://responsibledisclosure.jpmorganchase.com/hc/en-us
  - Defenestresque 6y ago
    >All attack payload data must use professional language Huh.
    - aidenn0 6y ago
      They probably want to check PoC into their repository and banks take a very dim view on unprofessional language in the DB. I would only be slightly surprised had the terms included: "All code must be written while wearing professional attire"

swiley 6y ago

I'm tempted to agree with you but I would be surprised if a law like that didn't make the situation worse.

ceejayoz 6y ago
The "we can't possibly write good laws" attitude is, IMO, a significant part of why we don't write good laws in the US.
- pmichaud 6y ago
  You may be right, but I suspect the causality is reversed: maybe there's a widespread sense that good laws cannot be written because, empirically, the people who make laws do so in devastatingly dumb ways. Whatever issue will immediately become a political football, and will end up being not only ineffective at the initial intention, but also include terrible side effects and dangerous footguns. Whether this is the result of a basically broken system of legislature, or of allowing the laws be drafted by the people they are supposed to protect against, or a combination of both, or something else entirely, I'm not qualified to say. But I can say this: when I hear of some political ambition to make something better with a new law, I don't expect it to go well.
  - jjoonathan 6y ago
    When I hear of some political ambition to make something better through inaction or through demolishing Chesterton's Fence, I don't expect it to go well.
- ashtonian 6y ago
  It's also a product if writing good laws is really hard because the people writing them are outside the industry, different from the people enforcing them, and often different from the people it affects. Better to remove barriers and things that silo and centralize power.
  - hnick 6y ago

chenpengcheng 6y ago

that is not going to happen in the US.

Schiendelman 6y ago
It only has to happen in a couple of states that do have a great track record for passing laws like that.

whiskeykilo 6y ago

It's slow going but we'll get there eventually. NIST made a recent revision to SP 800-53 that includes responsible disclosure as a recommendation: https://csrc.nist.gov/publications/detail/sp/800-53b/final https://csrc.nist.gov/publications/detail/sp/800-53b/final

Schiendelman 6y ago
Thanks very much, I hadn’t seen this and it’s good news!

franga2000 6y ago

Since the people in charge are basically the same rich morons as (or in the pocket of) the ones doing this to researchers, I wouldn't hold my breath. Best we can hope for is that the EU or some other trigger-happy regulators do the same for security as they tried to do for privacy: mandate a dedicated security contact that legally has to respond to your disclosure. Then at least we'll have some form of direct contact and not have to resort to twitter for "secure" disclosure.

Schiendelman 6y ago
There are a few states, notably California, that are just as good as the EU at drafting this kind of legislation.