3 ms·

What's the thinking there about the pros and cons? Specifically, is there any concern that this might help people who would exploit vulnerabilities rather than

What's the thinking there about the pros and cons? Specifically, is there any concern that this might help people who would exploit vulnerabilities rather than fix them?

totony 5y ago
You can probably already create a repo and use Github as an oracle for security vulns. This seems like it'd be very beneficial to people for which security is a second priority (so most developers). EDIT: Although your concerns might apply to unconfirmed public PRs
chews 5y ago
I don’t see very many cons with more information. The world is safer with this info in the public domain, will there be new exploits based on additional info? Sure, but that will get mitigated. Software, like law or medicine is a practice, meaning we aren’t experts... we’re just learning better ways to do things. This just opens the world to formal verification... for goodness sakes we’re just getting to fully reproducible deterministic software builds.
greysteil 5y ago
We believe that, on balance, the pros significantly outweigh the cons here. One big reason is that the alternative to this structured data being open source is that it lives in proprietary databases. In that world, attackers still have knowledge about these vulnerabilities - they don't need the structured data as much as defenders, and the licenses on those proprietary databases aren't going to deter them anyway (most are public for SEO reasons). Defenders on the other hand, often won't have as much or as high quality information.
freedomben 5y ago
This is a debate that raged for decades in the security community. Most people now agree that more info helps the white-hats more than it does the black-hats. It does make it easier for black-hats and gray-hats to gather info, and it does help script kiddies who write shotgun scripts, but when the info is private what often happens is the vulns get found and passed around the bad guy communities, while the good guys are unaware and caught off guard when they get hit. It also makes it drastically harder for good guys to figure out how the attacker got in when the info isn't public.

What's the thinking there about the pros and cons? Specifically, is there any concern that this might help people who would exploit vulnerabilities rather than fix them?

totony 5y ago

You can probably already create a repo and use Github as an oracle for security vulns. This seems like it'd be very beneficial to people for which security is a second priority (so most developers). EDIT: Although your concerns might apply to unconfirmed public PRs

chews 5y ago

I don’t see very many cons with more information. The world is safer with this info in the public domain, will there be new exploits based on additional info? Sure, but that will get mitigated. Software, like law or medicine is a practice, meaning we aren’t experts... we’re just learning better ways to do things. This just opens the world to formal verification... for goodness sakes we’re just getting to fully reproducible deterministic software builds.

greysteil 5y ago

We believe that, on balance, the pros significantly outweigh the cons here. One big reason is that the alternative to this structured data being open source is that it lives in proprietary databases. In that world, attackers still have knowledge about these vulnerabilities - they don't need the structured data as much as defenders, and the licenses on those proprietary databases aren't going to deter them anyway (most are public for SEO reasons). Defenders on the other hand, often won't have as much or as high quality information.

freedomben 5y ago

This is a debate that raged for decades in the security community. Most people now agree that more info helps the white-hats more than it does the black-hats. It does make it easier for black-hats and gray-hats to gather info, and it does help script kiddies who write shotgun scripts, but when the info is private what often happens is the vulns get found and passed around the bad guy communities, while the good guys are unaware and caught off guard when they get hit. It also makes it drastically harder for good guys to figure out how the attacker got in when the info isn't public.