4 ms·

Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but

by kjksf 5y ago

Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs) Then what? Relying on unpaid people to find and disclose vulnerabilities? And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking. What bureaucracy will we have to build to decide what is and isn't a vulnerability?

thephyber 5y ago
After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value

by kjksf 5y ago

thephyber 5y ago

After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value