3 ms·
They say "actively exploited vulnerability". So from the time you know the vulnerability is actively exploited is how I read it.
by Jensson 3y ago
They say "actively exploited vulnerability". So from the time you know the vulnerability is actively exploited is how I read it.
- hsbauauvhabzb 3y ago‘Actively exploited’ and ‘public knowledge / actively exploited en mass’ is also an important definition here.
- Arnt 3y agoAnd that looks very appropriate. If the vulnerability is actively exploited, telling the governments about it doesn't add to your hurry. You're already racing. If it were not exploited, then telling 27 governments would create 27 opportunities for leaks, which would add considerable pressure and disturb your best judgment. But the phrasing says "actively exploited". FWIW I once had a vulnerability reported to a widely used piece of software I alone maintained. I took a couple of days to fix and distribute it. Wrote a patch on the first evening, slept on it, looked hard on it the next day, had someone else review it, and finally released it about 40 hours after the report. Much more speed would have been difficult to achieve in a careful, responsible manner. My best friend once did something similar in 36 hours as part of a large team, and that was 36 really, really stressful hours. 24 sounds hard to my ears. Very difficult to make and distribute a reliable fix in that time. Knowing that the leaks may start in 25 hours... that would be bad.
- Kbelicius 3y ago24 hours if for notifying ENISA. Not to fix the vulnerability.
- Arnt 3y agoENISA will notify others, which means that the risk of leaking increases, which adds to your time pressure.
- adql 3y agoYeah, you'd have to actually do your fucking job. It's not up to one that did the fuck up to decide when people affected by the fuckup gets to know it happened.
- Arnt 3y agoThat's a nice way to put it. It's nice because you omit the not-so-nice specifics and keep it nicely generic. You don't specify what the fucking job is, and you don't specify who gets to decide. I live in a country whose law explicitly protects the freedom of action. You can choose what you want to do and exceptions need good justification. The justification has to be a great deal better than "didn't do your fucking job" because the requirements on the fucking job are set out by contracts. Vendors and customers decide on the contracts between them.
- aaomidi 3y agoIf it’s actively exploited, more attention on it is good and not bad. That’s what the language requires. I don’t really care what contracts you have with people, if your software has an actively exploited bug in it, people should know.
- barelysapient 3y agoOh really? Lets say an issue meets the reporting criteria but a patch can only be deployed physically. And the exploit is a trival wireless attack on a pacemaker. By your reasoning, making sure everyone knows about the issue is a desirable goal? Come on. There has to be nuance. Things that might _literally_ kill people probably shouldn't be reported the in the same way as a bug in a 15-year-old ink-jet printer driver.
- aaomidi 3y ago> There has to be nuance. Things that might _literally_ kill people probably shouldn't be reported the in the same way as a bug in a 15-year-old ink-jet printer driver. The problem is, its actively being exploited. You're just keeping systems and people uninformed and unable to make mitigations.
- chmod775 3y agoIt's not just that, read on: > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements.
- hcfman 3y agoCan we then add to the law that if the government is actively exploiting it that they can tell us as well ?