3 ms·

As someone with opinions on english usage (I was just eye-twitching at another front page HN story - the misused possessive on 'pilot's licence') I can see why

by Jedd 3y ago

As someone with opinions on english usage (I was just eye-twitching at another front page HN story - the misused possessive on 'pilot's licence') I can see why '0 day' may not perfectly capture or convey a certain type of exploit, but I don't think this would improve clarity. I've always distinguished a defect as a fault that was known prior to shipping (and hopefully documented) and a bug is a fault discovered after shipping. Draw your own analogies for SaaS, I guess. But given another popular distinction between defect and bug is more around design vs unexpected failures, it may be hubris to overload either of those terms with all the extra meaning that's already captured by '0 day'. As TFA notes, it'd be preferable if Microsoft didn't weasel away from commonly used and well understood words like vulnerability & exploit, or if they didn't eschew industry standard CVE reporting.

Veserv 3y ago
A defect is a fault or flaw that prevents the stated usage of a product. That is the plain meaning in literally every industry. A defective product is one fails to achieve its stated specifications, guarantees, or use. A airbag that, unknowingly at the time of manufacture, explodes after exposure to high heat or humidity has a defect. The product, now knowing that it contains a material defect, is defective. The use of bug, 0-day, vulnerability, exploit, etc. when making PR statements about security defects in software is a deliberate effort to downplay the severity of their failures. They deliberately avoid the use of the word “defect” because in many industrys that has literal legal consequences. At many companys, putting the word defect in a email has the general counsel descend, that is how serious it is. In contrast, calling a flaw that prevents the stated usage of your product a “bug” lets you sidestep all of that by mischaracterizing it as a legally meaningless “oopsie”. These flaws are defects. They clearly cause the products to not achieve their stated goal and the failures cause demonstrable harm. Calling them anything less is just handling these trillion dollar companys with kid gloves which is how we got into this systemically incompetent security mess. They need to be held to the same standards we hold other companys to and fix their damn products or get out of the businesses that they are too incapable to do acceptably.
- NoZebra120vClip 3y ago
  > not achieve their stated goal What is the stated goal of software packages whose EULA often includes a disclaimer, "NO WARRANTY OF FITNESS FOR ANY PURPOSE"?
  - Veserv 3y ago
    Same as for any physical product. If you are selling to a general consumer via a one-sided contract then there are implicit guarantees of fitness for the plainly advertised purpose that can almost never be waived at least in the US. Note that this does not usually apply to gifts so non-commercial OSS is likely unaffected. If you are selling to a business customer then they are accepting those terms. If they wish to then go on and use that product in their delivery to a general consumer then they are accepting the liability of verifying or making it fit for their purpose. If they wish to provide other guarantees then they are also responsible for those.
- Jedd 3y ago
  As noted, I don't believe you have consensus on the 'literally every industry' interpretation and use of the word defect. But even so, you seem to be claiming that the product doesn't match "stated specifications, guarantees, or use" (I find 'use' a bit vague, but nonetheless.) Can you point at the stated specifications, guarantees of AAD / Entra that are contraindicated by this exploit having occurred? If written guarantees have in fact not been met - that could be really interesting. > These flaws are defects. You use the word flaw a few times - as something similar to a fault, here as a synonym of, or a precursor state to, a defect. If we're being persnickety about language ...
  - Veserv 3y ago
    That is the plain meaning in basically every industry. That software people are allergic to it is because it would mean their products are defective and that is a no-no word because it means they are legally responsible for their failings. I am not being pedantic; coming up with highly-specialized words for the express purpose of downplaying failures and expecting others to play along is being pedantic and consumer-hostile. I am advocating consumer-friendly, industry standard language in this swamp of doublespeak. Are you arguing that the intended functionality of Exchange is leaking emails? No. Are you arguing that customers find their emails being leaked a desirable or neutral option? No. Are you arguing customers will accept a product that they know will leak their emails? No. So, a flaw that leaks emails makes the product unacceptable to the customer. The only possible defense for Microsoft here is that they accepted no liability or disclaimed all liability for leaking emails. It is certainly possible that Microsoft did that in their contracts. I applaud the skills of their salespeople and lawyers if they tricked the customer into accepting products inadequate for their needs. That does not stop me from calling it out as duplicitous, immoral behavior that should be stamped out. Part of this being pointing out how they have changed the words to make their statements seem less bad. The use of correct, industry-standard words makes it harder to misdirect customer intuition. Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. However, in the colloquial sense, they are absolutely selling a defective product as the consumer is not getting the plain meaning of what they were advertised (even though it is not contractually binding). I do not know about you, but I really think we should push for the consumer-friendly model over the lawyer-friendly one.
kQq9oHeAz6wLLS 3y ago
Delicious irony that your post contains this abuse of single quotes: > 'pilot's licence'
- Jedd 3y ago
  > Delicious irony that your post contains this abuse of single quotes: Obviously it's not irony, but neither is it an abuse. There are some regional variations in convention though. In my part of the world we differentiate the noun (licence) from the verb (license), and we also [can] use single quotes.

by Jedd 3y ago

Veserv 3y ago

A defect is a fault or flaw that prevents the stated usage of a product. That is the plain meaning in literally every industry. A defective product is one fails to achieve its stated specifications, guarantees, or use. A airbag that, unknowingly at the time of manufacture, explodes after exposure to high heat or humidity has a defect. The product, now knowing that it contains a material defect, is defective. The use of bug, 0-day, vulnerability, exploit, etc. when making PR statements about security defects in software is a deliberate effort to downplay the severity of their failures. They deliberately avoid the use of the word “defect” because in many industrys that has literal legal consequences. At many companys, putting the word defect in a email has the general counsel descend, that is how serious it is. In contrast, calling a flaw that prevents the stated usage of your product a “bug” lets you sidestep all of that by mischaracterizing it as a legally meaningless “oopsie”. These flaws are defects. They clearly cause the products to not achieve their stated goal and the failures cause demonstrable harm. Calling them anything less is just handling these trillion dollar companys with kid gloves which is how we got into this systemically incompetent security mess. They need to be held to the same standards we hold other companys to and fix their damn products or get out of the businesses that they are too incapable to do acceptably.

NoZebra120vClip 3y ago
> not achieve their stated goal What is the stated goal of software packages whose EULA often includes a disclaimer, "NO WARRANTY OF FITNESS FOR ANY PURPOSE"?
- Veserv 3y ago
  Same as for any physical product. If you are selling to a general consumer via a one-sided contract then there are implicit guarantees of fitness for the plainly advertised purpose that can almost never be waived at least in the US. Note that this does not usually apply to gifts so non-commercial OSS is likely unaffected. If you are selling to a business customer then they are accepting those terms. If they wish to then go on and use that product in their delivery to a general consumer then they are accepting the liability of verifying or making it fit for their purpose. If they wish to provide other guarantees then they are also responsible for those.
Jedd 3y ago
As noted, I don't believe you have consensus on the 'literally every industry' interpretation and use of the word defect. But even so, you seem to be claiming that the product doesn't match "stated specifications, guarantees, or use" (I find 'use' a bit vague, but nonetheless.) Can you point at the stated specifications, guarantees of AAD / Entra that are contraindicated by this exploit having occurred? If written guarantees have in fact not been met - that could be really interesting. > These flaws are defects. You use the word flaw a few times - as something similar to a fault, here as a synonym of, or a precursor state to, a defect. If we're being persnickety about language ...
- Veserv 3y ago
  That is the plain meaning in basically every industry. That software people are allergic to it is because it would mean their products are defective and that is a no-no word because it means they are legally responsible for their failings. I am not being pedantic; coming up with highly-specialized words for the express purpose of downplaying failures and expecting others to play along is being pedantic and consumer-hostile. I am advocating consumer-friendly, industry standard language in this swamp of doublespeak. Are you arguing that the intended functionality of Exchange is leaking emails? No. Are you arguing that customers find their emails being leaked a desirable or neutral option? No. Are you arguing customers will accept a product that they know will leak their emails? No. So, a flaw that leaks emails makes the product unacceptable to the customer. The only possible defense for Microsoft here is that they accepted no liability or disclaimed all liability for leaking emails. It is certainly possible that Microsoft did that in their contracts. I applaud the skills of their salespeople and lawyers if they tricked the customer into accepting products inadequate for their needs. That does not stop me from calling it out as duplicitous, immoral behavior that should be stamped out. Part of this being pointing out how they have changed the words to make their statements seem less bad. The use of correct, industry-standard words makes it harder to misdirect customer intuition. Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. However, in the colloquial sense, they are absolutely selling a defective product as the consumer is not getting the plain meaning of what they were advertised (even though it is not contractually binding). I do not know about you, but I really think we should push for the consumer-friendly model over the lawyer-friendly one.

kQq9oHeAz6wLLS 3y ago

Delicious irony that your post contains this abuse of single quotes: > 'pilot's licence'

Jedd 3y ago
> Delicious irony that your post contains this abuse of single quotes: Obviously it's not irony, but neither is it an abuse. There are some regional variations in convention though. In my part of the world we differentiate the noun (licence) from the verb (license), and we also [can] use single quotes.