5 ms·

Except for the communication and the lack of responsible disclosure. Publishing the exploit without contacting first the security teams of tools as big as postf

Except for the communication and the lack of responsible disclosure. Publishing the exploit without contacting first the security teams of tools as big as postfix... Is quite bad.

igor47 3y ago
Yup the postfix maintainers seem peeved: > Unfortunately, criticial information provided by the researcher was not passed on to Postfix maintainers before publication of the attack, otherwise we would certainly have convinced SEC Consult to change their time schedule until after people had a chance to update their Postfix systems.
noitpmeder 3y ago
[flagged]
- peblos 3y ago
  The timing is just less than ideal. They started disclosing in July and it looks like everything was very professional and responsible only to publish the week before Christmas. From the timeline, perhaps CERT/CC could have done more or could have been quicker in their review. 5th December is probably the absolute earliest reporting date, but published on 18 Dec after what I can only guess was nearly 2 weeks for internal review So, the decision is to publish the week before Christmas or wait until early/mid Jan when staff return and they took the less than ideal option to publish early, presumably in case they were scooped
  - tecleandor 3y ago
    Also, they only disclose to GMX, Microsoft and Cisco, when they clearly write in the article that there's quite a big quantity of Postfix servers impacted (more than a million by the mentioned figure): This might not seem bad at first, but looking at affected SMTP software on the Internet is a different story. After testing some popular e-mail software in their default configuration, it turned out that Postfix and Sendmail fulfil the requirements, are affected and can be smuggled to. Speaking globally, this is a lot (figure 31)!
deleted 3y ago
[deleted]
SAI_Peregrinus 3y ago
Responsible Disclosure traditionally has two forms: Coordinated & Full. They mixed the two for different projects, but it's still responsible to the end users. This is in opposition to irresponsible disclosure (selling exploits to attack groups).

Except for the communication and the lack of responsible disclosure. Publishing the exploit without contacting first the security teams of tools as big as postfix... Is quite bad.

igor47 3y ago

Yup the postfix maintainers seem peeved: > Unfortunately, criticial information provided by the researcher was not passed on to Postfix maintainers before publication of the attack, otherwise we would certainly have convinced SEC Consult to change their time schedule until after people had a chance to update their Postfix systems.

noitpmeder 3y ago

[flagged]

peblos 3y ago
The timing is just less than ideal. They started disclosing in July and it looks like everything was very professional and responsible only to publish the week before Christmas. From the timeline, perhaps CERT/CC could have done more or could have been quicker in their review. 5th December is probably the absolute earliest reporting date, but published on 18 Dec after what I can only guess was nearly 2 weeks for internal review So, the decision is to publish the week before Christmas or wait until early/mid Jan when staff return and they took the less than ideal option to publish early, presumably in case they were scooped
- tecleandor 3y ago
  Also, they only disclose to GMX, Microsoft and Cisco, when they clearly write in the article that there's quite a big quantity of Postfix servers impacted (more than a million by the mentioned figure): This might not seem bad at first, but looking at affected SMTP software on the Internet is a different story. After testing some popular e-mail software in their default configuration, it turned out that Postfix and Sendmail fulfil the requirements, are affected and can be smuggled to. Speaking globally, this is a lot (figure 31)!

deleted 3y ago

[deleted]

SAI_Peregrinus 3y ago

Responsible Disclosure traditionally has two forms: Coordinated & Full. They mixed the two for different projects, but it's still responsible to the end users. This is in opposition to irresponsible disclosure (selling exploits to attack groups).