3 ms·

> My only regret with dealing with the OpenBSD team was reporting the issue to them too quickly, as they are uninterested in waiting for any kind of coordinatio

> My only regret with dealing with the OpenBSD team was reporting the issue to them too quickly, as they are uninterested in waiting for any kind of coordination in disclosure. This BS with disclosure coordination and all the other crap vendors have been trying to train researchers to do for years needs to stop. You find a issue, you publish it, vendors need to deal with bad code and products in realtime, not when it suits them.

mschuster91 3y ago
While I agree in theory, in practice this will lead to bad actors ranging from trolls to cyberwar troops exploiting it immediately. There is IMHO no ethical alternative to responsible disclosure, and using actual people who can get harmed by having their information disclosed as pawns isn't the way to go forward.
- ExoticPearTree 3y ago
  Yes, but have that pain inflicted on end customers long enough and they will eventually transfer it to the vendors one way or another.
zbentley 3y ago
> vendors need to deal with bad code and products in realtime One of the main reasons for coordinated disclosure is that, over time, it has become evident that vendors will not do that. We can say it until we're blue in the face, but vendor behavior will remain largely unchanged regardless (there are a few bright spots, but not nearly enough). So you go to war with the army you have. In this case, that means frequently deferring/coordinating security event communications. As much as I wish the market would appropriately penalize vendors that encourage researchers to sit on 0-days, that rarely happens, and the cost of insecurity is passed onto consumers instead. Tl;dr delaying disclosure does suck, but you should still do it.
- salawat 3y ago
  Alas, it is the consumer that apparently drives pain reception for vendors, as they have no interest in minimizing consumer pain, but their own pain. Their own pain is defined as lost business. 'Tis the world we live in, so might as well get used to it.

mschuster91 3y ago

While I agree in theory, in practice this will lead to bad actors ranging from trolls to cyberwar troops exploiting it immediately. There is IMHO no ethical alternative to responsible disclosure, and using actual people who can get harmed by having their information disclosed as pawns isn't the way to go forward.

ExoticPearTree 3y ago
Yes, but have that pain inflicted on end customers long enough and they will eventually transfer it to the vendors one way or another.

zbentley 3y ago

> vendors need to deal with bad code and products in realtime One of the main reasons for coordinated disclosure is that, over time, it has become evident that vendors will not do that. We can say it until we're blue in the face, but vendor behavior will remain largely unchanged regardless (there are a few bright spots, but not nearly enough). So you go to war with the army you have. In this case, that means frequently deferring/coordinating security event communications. As much as I wish the market would appropriately penalize vendors that encourage researchers to sit on 0-days, that rarely happens, and the cost of insecurity is passed onto consumers instead. Tl;dr delaying disclosure does suck, but you should still do it.

salawat 3y ago
Alas, it is the consumer that apparently drives pain reception for vendors, as they have no interest in minimizing consumer pain, but their own pain. Their own pain is defined as lost business. 'Tis the world we live in, so might as well get used to it.