3 ms·

>… then there’s no reason… The reason is to avoid getting dragged by Rapid 7. If you don’t play by the generally accepted community standards for coordinated v

by c0pium 3y ago

>… then there’s no reason… The reason is to avoid getting dragged by Rapid 7. If you don’t play by the generally accepted community standards for coordinated vulnerability disclosure, you can expect the researchers to point that out as loudly as possible. It’s extortion, but the alternative is going back to companies ignoring security issues and not telling users about problems.

jillesvangurp 3y ago
I think the truth is probably in the middle. Big companies often release patches before they detail what is in them so as to not create a lot of zero day issues where they helpfully explain to hackers how to hack the unpatched masses of users. I can see why that is a good thing. At least I'd hate it if e.g. Apple published a detailed howto on how to hack me hours/days before I even see the patch they released along with it. Normal users and companies need some time. So, I can see why Jetbrains would want these patches out ASAP without alerting hackers to the notion that there are a lot of valuable corporate targets to hack. I guess that's why this article is titled "Rapid7 throws JetBrains under the bus ...". And their users, you could add. At least the article suggests "Exploits began within hours of the original disclosure, so patch now". Sounds like things might be getting ugly for some people out there. There might be more graceful ways to deal with this.
- c0pium 3y ago
  That’s not really how it works, unfortunately. Once a company releases a patch, the clock starts ticking on reverse engineering what that patch does. Amusingly, all of the efforts to shrink patch sizes have made this even easier, as you can quickly zero in on which bits are the important ones. The only safe thing to do is for companies to be loud about which patches relevant for security and for their customers to take them quickly. All else is security-via-hopium. > Normal users and companies need some time. Revil doesn’t care about your patch testing.

by c0pium 3y ago

jillesvangurp 3y ago

I think the truth is probably in the middle. Big companies often release patches before they detail what is in them so as to not create a lot of zero day issues where they helpfully explain to hackers how to hack the unpatched masses of users. I can see why that is a good thing. At least I'd hate it if e.g. Apple published a detailed howto on how to hack me hours/days before I even see the patch they released along with it. Normal users and companies need some time. So, I can see why Jetbrains would want these patches out ASAP without alerting hackers to the notion that there are a lot of valuable corporate targets to hack. I guess that's why this article is titled "Rapid7 throws JetBrains under the bus ...". And their users, you could add. At least the article suggests "Exploits began within hours of the original disclosure, so patch now". Sounds like things might be getting ugly for some people out there. There might be more graceful ways to deal with this.

c0pium 3y ago
That’s not really how it works, unfortunately. Once a company releases a patch, the clock starts ticking on reverse engineering what that patch does. Amusingly, all of the efforts to shrink patch sizes have made this even easier, as you can quickly zero in on which bits are the important ones. The only safe thing to do is for companies to be loud about which patches relevant for security and for their customers to take them quickly. All else is security-via-hopium. > Normal users and companies need some time. Revil doesn’t care about your patch testing.