5 ms·

What is the point of the dedicated vulnerability marketing websites? Like, for real, why do people buy a domain, configure dns, design a full webpage, setup som

What is the point of the dedicated vulnerability marketing websites? Like, for real, why do people buy a domain, configure dns, design a full webpage, setup some server somewhere? Is there some secret world I don't know about that's driven by how banger your vulnerability disclosure presentation is? Every one anymore has a full site. Is this what it takes to get attention these days? Everything, including computer bugs, needs a marketing campaign? Every time I see these sites I roll my fucking eyes at how ridiculous it is that people keep making them, but it seems to only be increasing in occurances. Can someone explain this to me because I feel like I'm missing something. Just feels like peak consumerism and attention economy bs that shouldn't be needed imo, but I hope I'm missing some crucial thing that makes these valid

saagarjha 3y ago
It's because when a news website wants to talk about the vulnerability they get a webpage to link to that is canonical and has all the information someone would want to get an accurate description of the issue.
- wutwutwat 3y ago
  Isn't that exactly what https://www.cve.org/ https://www.cve.org/ would be for?
  - HtmlProgrammer 3y ago
    Yes
  - saagarjha 3y ago
    No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.
    - wutwutwat 3y ago
      CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.
      - saagarjha 3y ago
        Yeah, that's not how Apple's CVEs work.
      - mrmuagi 3y ago
        On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue? I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc. I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?
        JadeNB 3y ago
        > schmorgus board I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).
        dskrvk 3y ago
        Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]
      - deleted 3y ago
        [deleted]
      - fullspectrumdev 3y ago
  - eep_social 3y ago
    Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.
    - wutwutwat 3y ago
      I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job
      - eep_social 3y ago
        That’s certainly your prerogative!
HtmlProgrammer 3y ago
Nope you’ve got it in one
judge2020 3y ago
This is hosted on GitHub Pages, so it takes very minimal resources to setup and keep running. The domain is also likely $10, assuming they didn't need to pay a squatter for it. I think it's just a trend for any any huge-scale vulnerability research team to put together a website for it, as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large. And it doesn't always happen. Log4shell, for example, was not its own website: https://news.ycombinator.com/item?id=29504755 https://news.ycombinator.com/item?id=29504755
- wutwutwat 3y ago
  > as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large. Feels like a dangerous way to gauge the severity of issues. What if the discloser doesn't have the funds or the skills to setup a dedicated website? Will it not get any attention since there's no yodawgiheardyoulike0days.com website to float up to the top of HN? This is what CVE severity scoring is for and what should be used, not the presence of a dedicated website, no?
  - saagarjha 3y ago
    CVE scoring is about as worthless as whether a vulnerability has a website.
    - wutwutwat 3y ago
      Maybe, but it's at least an agreed upon system and a centralized database and format, which can be improved since a org is behind it with the goal to make sec vul disclosure the best it can be. The wild west of marketing websites isn't advancing towards any sort of shared understanding.
      - saagarjha 3y ago
        I am 100% on board with free and easy assignment of CVEs and a central database of them. I just don't think they are a good place for keeping vulnerability details, because it is too rigid. Having a link to relevant details is good enough, and if the link happens to just include everything in it then I'm fine with that.
k8svet 3y ago
This site regularly upvotes posts on X (nee Twitter) and Medium and other sites that actively nag me. It would take me less than 6 minutes to register a domain on njalla, pay in crypto, add the DNS to cloudflare, and upload some static files to a GitHub repo. And no nagware! Even if it is self promotion, I couldn't be bothered to whine about this when I'm inundated with far more bullshit from far more prominent, frequent actors on a daily basis.
- wutwutwat 3y ago
  I don't get bothered by people doing it because they are able to, or care how long it takes them to spin it up, good for them. The thing that bothers me is that disclosing sec vulnerabilities isn't a popularity contest, and as you can see from other comments here, people are gauging the severity of the vulnerability based on if it has a fucking marketing website or not. That's not a good pattern to keep enforcing imo
  - k8svet 3y ago
    If people are actually judging the importance of a vuln based on "it has a domain" then my issue would be with them. People have all sorts of miscalibrated heuristics with which they judge things. Regardless of the originators intentions.
    - wutwutwat 3y ago
      Treat the problem not the symptoms. People can't use the marketing site to gauge severity if they don't exist.
  - ziddoap 3y ago
    Why is your question not directed at the people that bother you, if that is the case? Seems rather unproductive to question why the site exists when your problem is with people using the existence of the site to make decisions.
    - wutwutwat 3y ago
huijzer 3y ago
> Like, for real, why do people buy a domain, configure dns, design a full webpage, setup some server somewhere? Same can be said for personal blogs. The purpose is showing off. By the way, setting up a server nowadays is ridiculously easy and cheap. If you have done it a few times and you use a simple static site stack with CI then you can have a site live in 15-30 minuted including SSL and hosting for free (GitHub Pages, Cloudflare, or GitLab Pages for example).
- wutwutwat 3y ago
  Personal blogs, or any other website, have nothing to do with creating branding and dedicated websites to disclose security vulnerabilities. Computer bugs have logos.
auggierose 3y ago
It's a paper. Plenty of papers come with their own website. The purpose of a paper is to make its findings publicly accessible, so putting in the extra work for a website to accompany it is understandable.
deleted 3y ago
[deleted]
coryfklein 3y ago
The amount of time and effort they spent setting up the website – since this is 2023 and websites are super easy to set up – is probably dwarfed by the amount of time they spent on the vulnerability itself.
- wutwutwat 3y ago
  The time and effort isn't the concern, the precedent that a vulnerability isn't severe unless it has a marketing campaign these are setting is, and based on some comments here, it's taking place
  - calibas 3y ago
    They waited over a year before disclosing the vulnerability. Since Apple didn't fix it in that time, they're now relying on negative publicity to pressure Apple into fixing the issue. And the problem here is that Apple and other companies don't address these vulnerabilities until someone forces their hand. That's why a "marketing campaign" is required, unfortunately.
staplers 3y ago
Have developers really come full circle to "why do we make websites?"
- wutwutwat 3y ago
  Yes, that's what my comment was asking, why do we make websites, you nailed it, and I thank you for the concise way of asking what I took so many more words to ask above.
- logn 3y ago
  Yes, we dream of an alternate timeline with CVE promos on TCP/IP HyperCard https://www.wired.com/2002/08/hypercard-what-could-have-been/ https://www.wired.com/2002/08/hypercard-what-could-have-been...
Reptur 3y ago
In think its plausible that hosting it yourself ensures that companies can't exert pressure to have it removed.
gosub100 3y ago
maybe they want to maximize their career opportunities? It's gotten better over the years, but for a long time security researchers and white-hats toiled away and never even got a "thanks", sometimes they got legal threats. If I had the patience to work in this industry I'd want to maximize my returns.
weaksauce 3y ago
it's a webpage promoting a vulnerability they found and a paper they wrote and is owned by georgia institute of tech. they ~~have servers~~ are just using github pages and a budget already i'm sure for marketing. this is marketing.
deleted 3y ago
[deleted]

saagarjha 3y ago

It's because when a news website wants to talk about the vulnerability they get a webpage to link to that is canonical and has all the information someone would want to get an accurate description of the issue.

wutwutwat 3y ago
Isn't that exactly what https://www.cve.org/ https://www.cve.org/ would be for?
- HtmlProgrammer 3y ago
  Yes
- saagarjha 3y ago
  No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.
  - wutwutwat 3y ago
    CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.
    - saagarjha 3y ago
      Yeah, that's not how Apple's CVEs work.
    - mrmuagi 3y ago
      On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue? I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc. I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?
      - JadeNB 3y ago
        > schmorgus board I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).
        dskrvk 3y ago
        Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]
    - deleted 3y ago
      [deleted]
    - fullspectrumdev 3y ago
- eep_social 3y ago
  Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.
  - wutwutwat 3y ago
    I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job
    - eep_social 3y ago
      That’s certainly your prerogative!

HtmlProgrammer 3y ago

Nope you’ve got it in one

judge2020 3y ago

This is hosted on GitHub Pages, so it takes very minimal resources to setup and keep running. The domain is also likely $10, assuming they didn't need to pay a squatter for it. I think it's just a trend for any any huge-scale vulnerability research team to put together a website for it, as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large. And it doesn't always happen. Log4shell, for example, was not its own website: https://news.ycombinator.com/item?id=29504755 https://news.ycombinator.com/item?id=29504755

wutwutwat 3y ago
> as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large. Feels like a dangerous way to gauge the severity of issues. What if the discloser doesn't have the funds or the skills to setup a dedicated website? Will it not get any attention since there's no yodawgiheardyoulike0days.com website to float up to the top of HN? This is what CVE severity scoring is for and what should be used, not the presence of a dedicated website, no?
- saagarjha 3y ago
  CVE scoring is about as worthless as whether a vulnerability has a website.
  - wutwutwat 3y ago
    Maybe, but it's at least an agreed upon system and a centralized database and format, which can be improved since a org is behind it with the goal to make sec vul disclosure the best it can be. The wild west of marketing websites isn't advancing towards any sort of shared understanding.
    - saagarjha 3y ago
      I am 100% on board with free and easy assignment of CVEs and a central database of them. I just don't think they are a good place for keeping vulnerability details, because it is too rigid. Having a link to relevant details is good enough, and if the link happens to just include everything in it then I'm fine with that.

k8svet 3y ago

This site regularly upvotes posts on X (nee Twitter) and Medium and other sites that actively nag me. It would take me less than 6 minutes to register a domain on njalla, pay in crypto, add the DNS to cloudflare, and upload some static files to a GitHub repo. And no nagware! Even if it is self promotion, I couldn't be bothered to whine about this when I'm inundated with far more bullshit from far more prominent, frequent actors on a daily basis.

wutwutwat 3y ago
I don't get bothered by people doing it because they are able to, or care how long it takes them to spin it up, good for them. The thing that bothers me is that disclosing sec vulnerabilities isn't a popularity contest, and as you can see from other comments here, people are gauging the severity of the vulnerability based on if it has a fucking marketing website or not. That's not a good pattern to keep enforcing imo
- k8svet 3y ago
  If people are actually judging the importance of a vuln based on "it has a domain" then my issue would be with them. People have all sorts of miscalibrated heuristics with which they judge things. Regardless of the originators intentions.
  - wutwutwat 3y ago
    Treat the problem not the symptoms. People can't use the marketing site to gauge severity if they don't exist.
- ziddoap 3y ago
  Why is your question not directed at the people that bother you, if that is the case? Seems rather unproductive to question why the site exists when your problem is with people using the existence of the site to make decisions.
  - wutwutwat 3y ago

huijzer 3y ago

> Like, for real, why do people buy a domain, configure dns, design a full webpage, setup some server somewhere? Same can be said for personal blogs. The purpose is showing off. By the way, setting up a server nowadays is ridiculously easy and cheap. If you have done it a few times and you use a simple static site stack with CI then you can have a site live in 15-30 minuted including SSL and hosting for free (GitHub Pages, Cloudflare, or GitLab Pages for example).

wutwutwat 3y ago
Personal blogs, or any other website, have nothing to do with creating branding and dedicated websites to disclose security vulnerabilities. Computer bugs have logos.

auggierose 3y ago

It's a paper. Plenty of papers come with their own website. The purpose of a paper is to make its findings publicly accessible, so putting in the extra work for a website to accompany it is understandable.

deleted 3y ago

[deleted]

coryfklein 3y ago

The amount of time and effort they spent setting up the website – since this is 2023 and websites are super easy to set up – is probably dwarfed by the amount of time they spent on the vulnerability itself.

wutwutwat 3y ago
The time and effort isn't the concern, the precedent that a vulnerability isn't severe unless it has a marketing campaign these are setting is, and based on some comments here, it's taking place
- calibas 3y ago
  They waited over a year before disclosing the vulnerability. Since Apple didn't fix it in that time, they're now relying on negative publicity to pressure Apple into fixing the issue. And the problem here is that Apple and other companies don't address these vulnerabilities until someone forces their hand. That's why a "marketing campaign" is required, unfortunately.

staplers 3y ago

Have developers really come full circle to "why do we make websites?"

wutwutwat 3y ago
Yes, that's what my comment was asking, why do we make websites, you nailed it, and I thank you for the concise way of asking what I took so many more words to ask above.
logn 3y ago
Yes, we dream of an alternate timeline with CVE promos on TCP/IP HyperCard https://www.wired.com/2002/08/hypercard-what-could-have-been/ https://www.wired.com/2002/08/hypercard-what-could-have-been...

Reptur 3y ago

In think its plausible that hosting it yourself ensures that companies can't exert pressure to have it removed.

gosub100 3y ago

maybe they want to maximize their career opportunities? It's gotten better over the years, but for a long time security researchers and white-hats toiled away and never even got a "thanks", sometimes they got legal threats. If I had the patience to work in this industry I'd want to maximize my returns.

weaksauce 3y ago

it's a webpage promoting a vulnerability they found and a paper they wrote and is owned by georgia institute of tech. they ~~have servers~~ are just using github pages and a budget already i'm sure for marketing. this is marketing.

deleted 3y ago

[deleted]