3 ms·

I get naming security vulnerability make them easier to talk about and spread awareness. But I think if the answer to "should I drop everything and fix this" is

I get naming security vulnerability make them easier to talk about and spread awareness. But I think if the answer to "should I drop everything and fix this" is not yes, it doesn't need to be marketed so well.

Aissen 5y ago
On the contrary, if the FAQ entry is honest (and this is the first question), then I'd say let them market it however they like. But I fully understand how one could get quite a marketed-bugs-fatigue.
hannob 5y ago
If you look at past attacks that had a name and logo it's often not that these attacks were particularly dangerous. Think about Spectre. What these attacks often do however is breaking existing expectations. I think this attack ticks quite a few boxes there. It questions the idea that TLS can be "layered" on top of existing protocols and just be secure without consideration for the underlying protocols. It breaks security independently of all the fancy crypto we have in TLS 1.3 that we enforced due to previous attacks on weak crypto. It shows a generic problem with TLS that hasn't been tackled properly yet.
- tptacek 5y ago
  It's interesting because there's at least two audiences for vulnerability research. The preceding comment is the obvious audience: people wondering if they need to patch. But for some vulnerabilities, the more important audience is computer science. Alpaca might be almost irrelevant to people who operate systems, but it's profoundly relevant to people studying secure transports and their vulnerabilities. It very much deserves whatever name the team chose to gave it.
icecap12 5y ago
Just a guess, but I think some of this is because they want to present the story at a big security conference.
ChrisArchitect 5y ago
ha yeah, seems to a trend more this year to launch a full on dedicated domain about these vulnerabilities

3 ms·

I get naming security vulnerability make them easier to talk about and spread awareness. But I think if the answer to "should I drop everything and fix this" is

by that_guy_iain 5y ago

Aissen 5y ago
On the contrary, if the FAQ entry is honest (and this is the first question), then I'd say let them market it however they like. But I fully understand how one could get quite a marketed-bugs-fatigue.
hannob 5y ago
If you look at past attacks that had a name and logo it's often not that these attacks were particularly dangerous. Think about Spectre. What these attacks often do however is breaking existing expectations. I think this attack ticks quite a few boxes there. It questions the idea that TLS can be "layered" on top of existing protocols and just be secure without consideration for the underlying protocols. It breaks security independently of all the fancy crypto we have in TLS 1.3 that we enforced due to previous attacks on weak crypto. It shows a generic problem with TLS that hasn't been tackled properly yet.
- tptacek 5y ago
  It's interesting because there's at least two audiences for vulnerability research. The preceding comment is the obvious audience: people wondering if they need to patch. But for some vulnerabilities, the more important audience is computer science. Alpaca might be almost irrelevant to people who operate systems, but it's profoundly relevant to people studying secure transports and their vulnerabilities. It very much deserves whatever name the team chose to gave it.
icecap12 5y ago
Just a guess, but I think some of this is because they want to present the story at a big security conference.
ChrisArchitect 5y ago
ha yeah, seems to a trend more this year to launch a full on dedicated domain about these vulnerabilities