4 ms·

In the latter scenario it's not a good look for either party. JB looks like they want to slide under the radar but R7 looks like it's extorting them. From a b

by mc32 3y ago

In the latter scenario it's not a good look for either party. JB looks like they want to slide under the radar but R7 looks like it's extorting them. From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus?

ziddoap 3y ago
>From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus? Rapid7 is following the industry-wide best practices of coordinated vulnerability disclosure (CVD). If you don't like how they handled it, you'll have to avoid every reputable infosec company. The article does a bad job of explaining why silent patches are bad, and a bad job at explaining the normal, industry standard, CVD process.
- mc32 3y ago
  Yes, silent patches are bad --but even worse is publishing details about the vulnerability so it can be used as an exploit before there is a chance to push the patch out or make it available. So yes, vendor is not great trying to silently patch but even worse is a security vendor publishing how to exploit it before the patch is made available. Surely it would be in both of their interests to coordinate the disclosure to minimize the risk to the ultimate users. As a user a silent patch is better than there being published exploit paths.
  - ziddoap 3y ago
    The patch was available. >Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
    - mc32 3y ago
      That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible on JBs part as well as R7s part. They both are guilty of not having proper communication to reach a mutually agreeable result. It looks bad. R7 is making the other guy JB look less bad with the way they went about this. They both could have handles this better --but ultimately it looks worse for R7 from my PoV.
      - ziddoap 3y ago
        I understand your point of view, but this is pretty much all on JBs part in my opinion. They say as much in a recent blog post. >At this point, we made a decision not to make a coordinated disclosure with Rapid7 >We published a blog post about the release. This blog post intentionally didn’t mention the security issues in detail These points would have triggered Rapid7s silent patching policy, which would have sped up the entire timeline and lead to the current state of affairs. I don't consider that to be spiteful (the policy is out in the open, JB knew what they were doing and knew the consequences of not coordinating any longer), but that's just me.

by mc32 3y ago

ziddoap 3y ago

>From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus? Rapid7 is following the industry-wide best practices of coordinated vulnerability disclosure (CVD). If you don't like how they handled it, you'll have to avoid every reputable infosec company. The article does a bad job of explaining why silent patches are bad, and a bad job at explaining the normal, industry standard, CVD process.

mc32 3y ago
Yes, silent patches are bad --but even worse is publishing details about the vulnerability so it can be used as an exploit before there is a chance to push the patch out or make it available. So yes, vendor is not great trying to silently patch but even worse is a security vendor publishing how to exploit it before the patch is made available. Surely it would be in both of their interests to coordinate the disclosure to minimize the risk to the ultimate users. As a user a silent patch is better than there being published exploit paths.
- ziddoap 3y ago
  The patch was available. >Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
  - mc32 3y ago
    That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible on JBs part as well as R7s part. They both are guilty of not having proper communication to reach a mutually agreeable result. It looks bad. R7 is making the other guy JB look less bad with the way they went about this. They both could have handles this better --but ultimately it looks worse for R7 from my PoV.
    - ziddoap 3y ago
      I understand your point of view, but this is pretty much all on JBs part in my opinion. They say as much in a recent blog post. >At this point, we made a decision not to make a coordinated disclosure with Rapid7 >We published a blog post about the release. This blog post intentionally didn’t mention the security issues in detail These points would have triggered Rapid7s silent patching policy, which would have sped up the entire timeline and lead to the current state of affairs. I don't consider that to be spiteful (the policy is out in the open, JB knew what they were doing and knew the consequences of not coordinating any longer), but that's just me.