4 ms·

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

by akerl_ 4y ago

monocasa 4y ago
The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstechnica took his side that you shouldn't disclose publicly at all, missing the point that others might be actively exploiting the same vulnerability. You routinely see the same sentiment even on HN (thankfully in the minority now), missing the point that while finding exploits is hard work and generally takes very smart individuals, that's not to the point of being able to assume that someone else who wears a slightly darker hat didn't figure out the same bug.
- tptacek 4y ago
  I don't much care what Peter Bright thinks or said a decade ago. Peter Bright isn't a security researcher, or on a vendor security team. He's just some guy (or, was some guy) on Twitter. Project Zero, meanwhile, is the global gold standard for coordinated vulnerability disclosure. Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.
  - monocasa 4y ago
    He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft. And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays. Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
    - tptacek 4y ago
      I simply don't care what Peter Bright says, and neither does anybody else in the field. We're now arguing for the sake of arguing. It's plainly correct that the term "Responsible Disclosure" is disfavored, and disfavored for the reasons I say it is. I didn't come up with any of these things; I just work in vulnerability research (or used to) and know what the stories are.

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

by akerl_ 4y ago

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstechnica took his side that you shouldn't disclose publicly at all, missing the point that others might be actively exploiting the same vulnerability. You routinely see the same sentiment even on HN (thankfully in the minority now), missing the point that while finding exploits is hard work and generally takes very smart individuals, that's not to the point of being able to assume that someone else who wears a slightly darker hat didn't figure out the same bug.

tptacek 4y ago
I don't much care what Peter Bright thinks or said a decade ago. Peter Bright isn't a security researcher, or on a vendor security team. He's just some guy (or, was some guy) on Twitter. Project Zero, meanwhile, is the global gold standard for coordinated vulnerability disclosure. Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.
- monocasa 4y ago
  He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft. And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays. Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
  - tptacek 4y ago
    I simply don't care what Peter Bright says, and neither does anybody else in the field. We're now arguing for the sake of arguing. It's plainly correct that the term "Responsible Disclosure" is disfavored, and disfavored for the reasons I say it is. I didn't come up with any of these things; I just work in vulnerability research (or used to) and know what the stories are.