4 ms·

To me, this is not a difficult decision or a debate. Allowing vulnerabilities to remain open/undisclosed because your government approves of them... for one th

To me, this is not a difficult decision or a debate. Allowing vulnerabilities to remain open/undisclosed because your government approves of them... for one thing, they aren't only useable by your government/allies, you don't know who else knows about them. Our government's approach of finding security vulnerabilities and keeping them for their own use (instead of responsibly reporting them to get fixed) puts all our security in danger. There isn't much we can do about that (except, well, try to use our "democracy" to get the government to behave differently). But in USA at least, private citizens can't generally be compelled to cooperate. If engineers at a private company find a vulnerability, it should be responsibly dealt with to fix it. No matter who else knows about it or may be taking advantage of it. I think it is unethical for a software engineer to do or go along with anything else.

cowmoo728 6y ago
The article cites that it raised alarms inside Google. I'm trying to imagine the furor that would be unleashed if Google told its employees that they weren't allowed to fix a security bug on order of the US government. There would have been massive pushback.
- SpicyLemonZest 6y ago
  Yeah, it's weird that this is even a question from an employee perception perspective. I'm extraordinarily sympathetic to US intelligence agencies by our industry's standards, and even I would see that as a red line.
- dylan604 6y ago
  >weren't allowed to fix a security bug on order of the US government What would happen? "Order of the US gov't" makes it sounds like serious legal ramifications would be handed out if violations were to occur. First, what would this look like? The CEO gets arrested? CTO? We've already seen that doesn't happen. The dev that pushed the change to fix the bug gets arrested, the PM in charge? Sanctions? Fines? All of this would have to have some legal standing in a court somewhere, otherwise, the offenders would have to be moved to some black site to prevent them from using any/all means to defend themselves. In otherwords, it seems sort of like an empty threat and bluffing to someone not dealing with the stress of that particular moment.
  - casefields 6y ago
    Former Qwest CEO says refusal to comply with NSA spying landed him in jail: https://www.rt.com/usa/qwest-ceo-nsa-jail-604/ https://www.rt.com/usa/qwest-ceo-nsa-jail-604/ NSLs are alive and real: https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
    - dylan604 6y ago
      "Former Qwest CEO Joseph Nacchio, who spent over four years in prison for insider trading, now says his conviction was based on his company’s refusal to cooperate with NSA requests to spy on its customers." "Nacchio believes his conviction was in retaliation for his refusal to play ball with legally dubious NSA spying requests." So, was he in jail for insider trading or violating an NSL? There's a difference between being convicted for violating a gov't order and someone pissed off at you to dig up dirt to put you in jail for something you did do. Lot's of people in jail believe they are in jail for the wrong reasons. Don't confuse my arguments as being in support of NSA systemic invasion of privacy. Just saying sometimes guilty people try to shift blame. I understand the concept of NSLs. What I was really trying to get at is the fact that in all of the corporate shenanigans that have ocurred in recent times, no indivduals gets punished for actually doing the thing that was bad. The evilCorps get some fines levied or something similarly slap on the wrist level, but that's it.
      - casefields 6y ago
        It's a fair criticism that we can't really know the truth on. If a nation state wants to railroad you—a single person—with the resources of the NSA/CIA at their disposal, how are you going to defend yourself? You could live off the grid like Crazy Ted, but that's an extreme reaction that most won't take, let alone a ceo of a major corporation. The government is made of people just like you and me. Couldn't you see some folks in the national security state thinking a person was standing in the way of keeping America safe? Collateral damage but necessary. I'm not saying it's good or should be allowed, but I can empathize with the mindset of that individual. Same thing happens with prosecutors/detectives when they get tunnel vision over a person that later is exonerated. They deal with bad people so often they become jaded by human nature and everything looks like a nail for their hammer. 2011: "New Evidence Adds Doubt to FBI’s Case Against Anthrax Suspect": https://www.propublica.org/article/new-evidence-disputes-case-against-bruce-e-ivins https://www.propublica.org/article/new-evidence-disputes-cas...
wepple 6y ago
I think the article was advocating more for not disclosing the vulnerabilities and silently patching them. So the vuln goes away but no fingers are pointed. Which is also a silly argument; enough security researchers will watch the updates/patches and immediately spot the vulnerabilities, then accuse Google of brushing it under the carpet and being in bed with govt. Not patching is not doable. Patching silently is not doable. Vendors should do what google did. All of them.
- unishark 6y ago
  It was a long and meandering article that seemed to be fishing around for every possibly related controversy it could find (and it worked, look at all the people talking about the article). But Google's blog post weren't just about the vulnerabilities so much as the hacking operation, which had exploited multiple different vulnerabilities. As for publicizing the operation itself, which was the real controversial decision, they went halfway on it, by holding back key details. https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i...

cowmoo728 6y ago

The article cites that it raised alarms inside Google. I'm trying to imagine the furor that would be unleashed if Google told its employees that they weren't allowed to fix a security bug on order of the US government. There would have been massive pushback.

SpicyLemonZest 6y ago
Yeah, it's weird that this is even a question from an employee perception perspective. I'm extraordinarily sympathetic to US intelligence agencies by our industry's standards, and even I would see that as a red line.
dylan604 6y ago
>weren't allowed to fix a security bug on order of the US government What would happen? "Order of the US gov't" makes it sounds like serious legal ramifications would be handed out if violations were to occur. First, what would this look like? The CEO gets arrested? CTO? We've already seen that doesn't happen. The dev that pushed the change to fix the bug gets arrested, the PM in charge? Sanctions? Fines? All of this would have to have some legal standing in a court somewhere, otherwise, the offenders would have to be moved to some black site to prevent them from using any/all means to defend themselves. In otherwords, it seems sort of like an empty threat and bluffing to someone not dealing with the stress of that particular moment.
- casefields 6y ago
  Former Qwest CEO says refusal to comply with NSA spying landed him in jail: https://www.rt.com/usa/qwest-ceo-nsa-jail-604/ https://www.rt.com/usa/qwest-ceo-nsa-jail-604/ NSLs are alive and real: https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
  - dylan604 6y ago
    "Former Qwest CEO Joseph Nacchio, who spent over four years in prison for insider trading, now says his conviction was based on his company’s refusal to cooperate with NSA requests to spy on its customers." "Nacchio believes his conviction was in retaliation for his refusal to play ball with legally dubious NSA spying requests." So, was he in jail for insider trading or violating an NSL? There's a difference between being convicted for violating a gov't order and someone pissed off at you to dig up dirt to put you in jail for something you did do. Lot's of people in jail believe they are in jail for the wrong reasons. Don't confuse my arguments as being in support of NSA systemic invasion of privacy. Just saying sometimes guilty people try to shift blame. I understand the concept of NSLs. What I was really trying to get at is the fact that in all of the corporate shenanigans that have ocurred in recent times, no indivduals gets punished for actually doing the thing that was bad. The evilCorps get some fines levied or something similarly slap on the wrist level, but that's it.
    - casefields 6y ago
      It's a fair criticism that we can't really know the truth on. If a nation state wants to railroad you—a single person—with the resources of the NSA/CIA at their disposal, how are you going to defend yourself? You could live off the grid like Crazy Ted, but that's an extreme reaction that most won't take, let alone a ceo of a major corporation. The government is made of people just like you and me. Couldn't you see some folks in the national security state thinking a person was standing in the way of keeping America safe? Collateral damage but necessary. I'm not saying it's good or should be allowed, but I can empathize with the mindset of that individual. Same thing happens with prosecutors/detectives when they get tunnel vision over a person that later is exonerated. They deal with bad people so often they become jaded by human nature and everything looks like a nail for their hammer. 2011: "New Evidence Adds Doubt to FBI’s Case Against Anthrax Suspect": https://www.propublica.org/article/new-evidence-disputes-case-against-bruce-e-ivins https://www.propublica.org/article/new-evidence-disputes-cas...

wepple 6y ago

I think the article was advocating more for not disclosing the vulnerabilities and silently patching them. So the vuln goes away but no fingers are pointed. Which is also a silly argument; enough security researchers will watch the updates/patches and immediately spot the vulnerabilities, then accuse Google of brushing it under the carpet and being in bed with govt. Not patching is not doable. Patching silently is not doable. Vendors should do what google did. All of them.

unishark 6y ago
It was a long and meandering article that seemed to be fishing around for every possibly related controversy it could find (and it worked, look at all the people talking about the article). But Google's blog post weren't just about the vulnerabilities so much as the hacking operation, which had exploited multiple different vulnerabilities. As for publicizing the operation itself, which was the real controversial decision, they went halfway on it, by holding back key details. https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i...