4 ms·

"Coordinated disclosure" is the orwellian reimagining here. The only reason why the industry settled on the responsible disclosure process is that works regard

"Coordinated disclosure" is the orwellian reimagining here. The only reason why the industry settled on the responsible disclosure process is that works regardless of how much vendor coordination occurs, or even if they are technically responding to emails but really just stalling indefinitely.

tptacek 4y ago
No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".
- monocasa 4y ago
  > No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some focus time from the various sauron-esque eyes that are corporate attention by converting a 'bug report' into an 'impending pr nightmare bomb with a known timer'. It's a similar hack to complaining on twitter to deal with a marketing department instead of calling in to a customer service line that's just trying to get you to go away. > It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible". The point of calling it responsible is to defend the researchers who have massively less power in the relationship against the vendors. Even now you'll see whitehats lambasted for eventually disclosing after a vendor dragged their ass. Beyond that, yeah you can't please everyone.
  - akerl_ 4y ago
    What's an example of a researcher being lambasted for disclosing a vulnerability to the public?
    - monocasa 4y ago
      The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstechnica took his side that you shouldn't disclose publicly at all, missing the point that others might be actively exploiting the same vulnerability. You routinely see the same sentiment even on HN (thankfully in the minority now), missing the point that while finding exploits is hard work and generally takes very smart individuals, that's not to the point of being able to assume that someone else who wears a slightly darker hat didn't figure out the same bug.
      - tptacek 4y ago
        I don't much care what Peter Bright thinks or said a decade ago. Peter Bright isn't a security researcher, or on a vendor security team. He's just some guy (or, was some guy) on Twitter. Project Zero, meanwhile, is the global gold standard for coordinated vulnerability disclosure. Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.
        monocasa 4y ago
        He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft. And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays. Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
  - tptacek 4y ago
    As Google proved long ago, the only thing you have to do to get vendors to fix their shitty code is to set a fixed timeline for disclosure; just tell the vendor "please let us know when this is patched, and we're disclosing regardless after 60 days". The point of calling it "responsible" has nothing to do with defending researchers; it's literally the opposite. The norms of "responsible" disclosure were absolutely not the norms of vulnerability reearchers of the time. The term was invented back in the early aughts by @stake, then the largest software security consultancy in the world (my company, Matasano, was essentially a spin-off of @stake; one of my cofounders was an @stake cofounder). This is one of those things, like "Zero Trust Networking", where people read the term, (reasonably) believe they understand what the words mean, and then axiomatically derive the concept. But, no, the concept has its own history and its own meaning; the words have little to do with it (except that here, it's especially obvious what's problematic about the words themselves). The industry has largely moved away from "Responsible" disclosure to "Coordinated" disclosure, for all the reasons I've given here. Even CERT, the most conservative organization in software security, uses the new term now. Later edit This originally read The norms of "responsible" disclosure were absolutely not the norms of "Responsible Disclosure", which was a typo.
    - monocasa 4y ago
      The use of 'responsible' wrt vulnerability disclosure is thought to at least go back to 2001's essay "It’s Time to End Information Anarchy", and I know that the adjective 'responsible' was being thrown around wrt vulnarability disclosure before that. @stake did not invent the term in the early aughts. https://web.archive.org/web/20011109045330if_/http://www.microsoft.com:80/technet/treeview/default.asp?url=/technet/columns/security/noarch.asp https://web.archive.org/web/20011109045330if_/http://www.mic... Yes, CERT has moved using CVD, but I argue that's because of their conservationism. They don't want to rock the boat and tend towards vendor friendly, neutral language. That makes sense for their niche. And just throwing it out there that the older term that's actively being erased because its implications are unfriendly to entrenched interests isn't the "Orwellian" one.
      - tptacek 4y ago

tptacek 4y ago

No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".

monocasa 4y ago
> No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some focus time from the various sauron-esque eyes that are corporate attention by converting a 'bug report' into an 'impending pr nightmare bomb with a known timer'. It's a similar hack to complaining on twitter to deal with a marketing department instead of calling in to a customer service line that's just trying to get you to go away. > It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible". The point of calling it responsible is to defend the researchers who have massively less power in the relationship against the vendors. Even now you'll see whitehats lambasted for eventually disclosing after a vendor dragged their ass. Beyond that, yeah you can't please everyone.
- akerl_ 4y ago
  What's an example of a researcher being lambasted for disclosing a vulnerability to the public?
  - monocasa 4y ago
    The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstechnica took his side that you shouldn't disclose publicly at all, missing the point that others might be actively exploiting the same vulnerability. You routinely see the same sentiment even on HN (thankfully in the minority now), missing the point that while finding exploits is hard work and generally takes very smart individuals, that's not to the point of being able to assume that someone else who wears a slightly darker hat didn't figure out the same bug.
    - tptacek 4y ago
      I don't much care what Peter Bright thinks or said a decade ago. Peter Bright isn't a security researcher, or on a vendor security team. He's just some guy (or, was some guy) on Twitter. Project Zero, meanwhile, is the global gold standard for coordinated vulnerability disclosure. Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.
      - monocasa 4y ago
        He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft. And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays. Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
- tptacek 4y ago
  As Google proved long ago, the only thing you have to do to get vendors to fix their shitty code is to set a fixed timeline for disclosure; just tell the vendor "please let us know when this is patched, and we're disclosing regardless after 60 days". The point of calling it "responsible" has nothing to do with defending researchers; it's literally the opposite. The norms of "responsible" disclosure were absolutely not the norms of vulnerability reearchers of the time. The term was invented back in the early aughts by @stake, then the largest software security consultancy in the world (my company, Matasano, was essentially a spin-off of @stake; one of my cofounders was an @stake cofounder). This is one of those things, like "Zero Trust Networking", where people read the term, (reasonably) believe they understand what the words mean, and then axiomatically derive the concept. But, no, the concept has its own history and its own meaning; the words have little to do with it (except that here, it's especially obvious what's problematic about the words themselves). The industry has largely moved away from "Responsible" disclosure to "Coordinated" disclosure, for all the reasons I've given here. Even CERT, the most conservative organization in software security, uses the new term now. Later edit This originally read The norms of "responsible" disclosure were absolutely not the norms of "Responsible Disclosure", which was a typo.
  - monocasa 4y ago
    The use of 'responsible' wrt vulnerability disclosure is thought to at least go back to 2001's essay "It’s Time to End Information Anarchy", and I know that the adjective 'responsible' was being thrown around wrt vulnarability disclosure before that. @stake did not invent the term in the early aughts. https://web.archive.org/web/20011109045330if_/http://www.microsoft.com:80/technet/treeview/default.asp?url=/technet/columns/security/noarch.asp https://web.archive.org/web/20011109045330if_/http://www.mic... Yes, CERT has moved using CVD, but I argue that's because of their conservationism. They don't want to rock the boat and tend towards vendor friendly, neutral language. That makes sense for their niche. And just throwing it out there that the older term that's actively being erased because its implications are unfriendly to entrenched interests isn't the "Orwellian" one.
    - tptacek 4y ago