3 ms·

I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large

I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline before you "go public?" Wouldn't that be something you do later on if it appears that they're just blowing you off and won't do anything about it? I don't think this applies to the reporter in this case, but it does seem like there's a bit of a trend in security research lately to capitalize on the publicity of finding a vulnerability for one's own personal branding. That feels a bit disingenuous. Not that the appropriate response would be to threaten someone with legal action.

Cheezewheel 3y ago
Do you disagree that Users might be entitled to know when a corporation is misusing their private, sensitive information? What is ethical does not begin and end with the corporations best interest, the users whose private information is being mishandled are the victims here, let us not lose perspective.
- InSteady 3y ago
  Users who have been falsely assured that their data is both totally anonymous and "100% secure." On the other hand, assuming the app creators we in far over their heads when it comes to proper security, I have to wonder if they started off cordially and then freaked out a short while later because after trying, they realized there was no possible way for them to correct the issue in the given timeline. So in desperation they resorted to something drastic (and arguably unethical) to cover their asses.
pie_flavor 3y ago
It doesn't give them any wiggle room to lead you on, it doesn't give you any wiggle room to say 'unacceptable or I blow the whistle tomorrow', it removes your judgement of the situation from the disclosure entirely. It is the safest option for people who are great at finding things worth disclosing but not so great at situation-judging. It's not about personal branding, it's about protecting the users of the app. Either the app fixes the vulnerability so the users are no longer in danger, or the users are made aware that they are in danger.
Lalabadie 3y ago
Security researchers have a duty to users and industry first, then to the specific companies they are disclosing to. Most companies, without time pressure, do absolutely nil to fix the issues they are made aware of. It's completely fine to discuss or request a different disclosure date when communicating with researchers. The delay is their protection against inaction.

Cheezewheel 3y ago

Do you disagree that Users might be entitled to know when a corporation is misusing their private, sensitive information? What is ethical does not begin and end with the corporations best interest, the users whose private information is being mishandled are the victims here, let us not lose perspective.

InSteady 3y ago
Users who have been falsely assured that their data is both totally anonymous and "100% secure." On the other hand, assuming the app creators we in far over their heads when it comes to proper security, I have to wonder if they started off cordially and then freaked out a short while later because after trying, they realized there was no possible way for them to correct the issue in the given timeline. So in desperation they resorted to something drastic (and arguably unethical) to cover their asses.

pie_flavor 3y ago

It doesn't give them any wiggle room to lead you on, it doesn't give you any wiggle room to say 'unacceptable or I blow the whistle tomorrow', it removes your judgement of the situation from the disclosure entirely. It is the safest option for people who are great at finding things worth disclosing but not so great at situation-judging. It's not about personal branding, it's about protecting the users of the app. Either the app fixes the vulnerability so the users are no longer in danger, or the users are made aware that they are in danger.

Lalabadie 3y ago

Security researchers have a duty to users and industry first, then to the specific companies they are disclosing to. Most companies, without time pressure, do absolutely nil to fix the issues they are made aware of. It's completely fine to discuss or request a different disclosure date when communicating with researchers. The delay is their protection against inaction.