6 ms·

In this particular case, there is a strong reason to expect exploitation in the wild to already be occurring (because it's an intentional backdoor) and this wou

In this particular case, there is a strong reason to expect exploitation in the wild to already be occurring (because it's an intentional backdoor) and this would change the risk calculus around disclosure timelines. But in the general case, it's normal for 90 days to be given for the coordinated patching of even very severe vulnerabilities -- you are giving time not just to the project maintainers, but to the users of the software to finish updating their systems to a new fixed release, before enough detail to easily weaponize the vulnerability is shared. Google Project Zero is an example of a team with many critical impact findings using a 90-day timeline.

ang_cire 3y ago
As someone in security who doesn't work at a major place that get invited to the nice pre-notification notifications, I hate this practice. My customers and business are not any less important or valuable than anyone else's, and I should not be left being potentially exploited, and my customers harmed, for 90 more days while the big guys get to patch their systems (thinking of e.g. Log4J, where Amazon, Meta, Google, and others were told privately how to fix their systems, before others were even though the fix was simple). Likewise, as a customer I should get to know as soon as someone's software is found vulnerable, so I can then make the choice whether to continue to subject myself to the risk of continuing to use it until it gets patched.
- cjbprime 3y ago
  OpenSSL's "notification of an upcoming critical release" is public, not private. You do get to know that the vulnerability exists quickly, and you could choose to stop using OpenSSL altogether (among other mitigations) once that email goes out.
  - sidewndr46 3y ago
    if your system has already been compromised at the root level, it does not matter in the least bit
    - Thorrez 3y ago
      Well if you assume everyone has already been exploited, disclosing quickly vs slowly won't prevent that. Also, if something is being actively exploited, usually there's no or very little embargo.
- wyldberry 3y ago
  I empathize with this as I've been in the same boat, but all entities are not equal when performing triage.
- freedomben 3y ago
  Being in a similar boat, I heartily agree. But I don't want anyone else to get notified immediately because the odds that somebody will start exploiting people before a patch is available is pretty high. Since I can't have both, I will choose the 90 days for the project to get patches done and all the packagers to include them and make them available, so that by the time it's public knowledge I'm already patched. I think this is a Tragedy of the Commons type of problem. Caveat: This assume the vuln is found by a white hat. If it's being exploited already or is known to others, then I fully agree the disclosure time should be eliminated and it's BS for the big companies to get more time than us.
- oceanplexian 3y ago
  Yeah I worked in FAANG when we got the advance notice of a number of CVEs. Personally I think it's shady, I don't care how big Amazon or Google is, they shouldn't get special privileges because they are a large corporation.
  - kelnos 3y ago
    I don't think the rationale is that they are a large corporation or have lots of money. It's that they have many, many, many more users that would be affected than most companies have.
    - sdenton4 3y ago
      I imagine they also have significant resources to contribute to dealing with breaches - eg, analysing past cookouts by the bad actor, designing mitigations, etc.
- hatter 3y ago
  > My ... business are not any less ... valuable than anyone else's, Plainly untrue. The reason they keep distribution minimal is to maximise the chance of keeping the vuln secret. Your business is plainly less valuable than google, than walmart, than godaddy, than BoA. Maybe you're some big cheese with a big reputation to keep, but seeing as you're feeling excluded, I guess these orgs have no more reason to trust you than they have to trust me, or hundreds of thousands of others who want to know. If they let you in, they'd let all the others in, and odds are greatly increased that now your customers are at risk from something one of these others has worked out, and either blabbed about or has themselves a reason to exploit it. Similarly plainly, by disclosing to 100 major companies, they protect a vast breadth of consumers/customer-businesses of these major companies at a risk of 10,000,000/100 (or even less, given they may have more valuable reputation to keep). Changing that risk to 12,000,000/10,000 is, well, a risk they don't feel is worth taking.
  - squeaky-clean 3y ago
    > Your business is plainly less valuable than google, than walmart, than godaddy, than BoA. The company I work for has a market cap roughly 5x that of goDaddy and we're responsible for network connected security systems that potentially control whether a person can physically access your home, school, or business. We were never notified of this until this HN thread. If your BofA account gets hacked you lose money. If your GoDaddy account gets hacked you lose your domain. If Walmart gets hacked they lose... What money and have logistics issues for a while? Thankfully my company's products have additional safeguards and this isn't a breach for us. But what if it was? Our customers can literally lose their lives if someone cracks the security and finds a way to remotely open all the locks in their home or business. Don't tell me that some search engine profits or someone's emails history is "more valuable" than 2000 schoolchildren's lives. How about you give copies of the keys to your apartment and a card containing your address to 50 random people on the streets and see if you still feel that having your Gmail account hacked is more valuable.
    - SonOfLilit 3y ago
      Sorry, but that's not a serious risk analysis. The average person would be hurt a lot more by a godaddy breach by a state actor than by a breach of your service by a state actor.
- School-Cotton 3y ago
  > My customers and business are not any less important or valuable than anyone else's Of course they are. If Red Hat has a million times more customers than you do then they are collectively more valuable almost by definition.
  - InvertedRhodium 3y ago
    If OP is managing something that is critical to life - think fire suppression controllers, or computers that are connected to medical equipment, I think it becomes very difficult to compare that against financial assets.
    - solarengineer 3y ago
      I can think of two approaches for such companies: a. Use commercial OS vendors who will push out fixes. b. Set up a Continuous Integration process where everything is open source and is built from the ground up, with some reliance on open source platforms such as distros. One needs different types of competence and IT Operational readiness in each approach.
      - squeaky-clean 3y ago
        > b. Set up a Continuous Integration process where everything is open source and is built from the ground up, with some reliance on open source platforms such as distros. How would that have prevented this backdoor?
    - jen20 3y ago
      Such systems should be airgapped…
    - ajdlinux 3y ago
      At a certain scale, "economic" systems become critical to life. Someone who has sufficiently compromised a systemically-important bank can do things that would result in riots breaking out on the street all over a country.
    - 3y ago
- voidfunc 3y ago
  > My customers and business are not any less important or valuable than anyone else's Hate to break it to you but yes they are.
hulitu 3y ago
> but to the users of the software to finish updating their systems to a new fixed release, Is there "a new fixed release" ?

ang_cire 3y ago

As someone in security who doesn't work at a major place that get invited to the nice pre-notification notifications, I hate this practice. My customers and business are not any less important or valuable than anyone else's, and I should not be left being potentially exploited, and my customers harmed, for 90 more days while the big guys get to patch their systems (thinking of e.g. Log4J, where Amazon, Meta, Google, and others were told privately how to fix their systems, before others were even though the fix was simple). Likewise, as a customer I should get to know as soon as someone's software is found vulnerable, so I can then make the choice whether to continue to subject myself to the risk of continuing to use it until it gets patched.

cjbprime 3y ago
OpenSSL's "notification of an upcoming critical release" is public, not private. You do get to know that the vulnerability exists quickly, and you could choose to stop using OpenSSL altogether (among other mitigations) once that email goes out.
- sidewndr46 3y ago
  if your system has already been compromised at the root level, it does not matter in the least bit
  - Thorrez 3y ago
    Well if you assume everyone has already been exploited, disclosing quickly vs slowly won't prevent that. Also, if something is being actively exploited, usually there's no or very little embargo.
wyldberry 3y ago
I empathize with this as I've been in the same boat, but all entities are not equal when performing triage.
freedomben 3y ago
Being in a similar boat, I heartily agree. But I don't want anyone else to get notified immediately because the odds that somebody will start exploiting people before a patch is available is pretty high. Since I can't have both, I will choose the 90 days for the project to get patches done and all the packagers to include them and make them available, so that by the time it's public knowledge I'm already patched. I think this is a Tragedy of the Commons type of problem. Caveat: This assume the vuln is found by a white hat. If it's being exploited already or is known to others, then I fully agree the disclosure time should be eliminated and it's BS for the big companies to get more time than us.
oceanplexian 3y ago
Yeah I worked in FAANG when we got the advance notice of a number of CVEs. Personally I think it's shady, I don't care how big Amazon or Google is, they shouldn't get special privileges because they are a large corporation.
- kelnos 3y ago
  I don't think the rationale is that they are a large corporation or have lots of money. It's that they have many, many, many more users that would be affected than most companies have.
  - sdenton4 3y ago
    I imagine they also have significant resources to contribute to dealing with breaches - eg, analysing past cookouts by the bad actor, designing mitigations, etc.
hatter 3y ago
> My ... business are not any less ... valuable than anyone else's, Plainly untrue. The reason they keep distribution minimal is to maximise the chance of keeping the vuln secret. Your business is plainly less valuable than google, than walmart, than godaddy, than BoA. Maybe you're some big cheese with a big reputation to keep, but seeing as you're feeling excluded, I guess these orgs have no more reason to trust you than they have to trust me, or hundreds of thousands of others who want to know. If they let you in, they'd let all the others in, and odds are greatly increased that now your customers are at risk from something one of these others has worked out, and either blabbed about or has themselves a reason to exploit it. Similarly plainly, by disclosing to 100 major companies, they protect a vast breadth of consumers/customer-businesses of these major companies at a risk of 10,000,000/100 (or even less, given they may have more valuable reputation to keep). Changing that risk to 12,000,000/10,000 is, well, a risk they don't feel is worth taking.
- squeaky-clean 3y ago
  > Your business is plainly less valuable than google, than walmart, than godaddy, than BoA. The company I work for has a market cap roughly 5x that of goDaddy and we're responsible for network connected security systems that potentially control whether a person can physically access your home, school, or business. We were never notified of this until this HN thread. If your BofA account gets hacked you lose money. If your GoDaddy account gets hacked you lose your domain. If Walmart gets hacked they lose... What money and have logistics issues for a while? Thankfully my company's products have additional safeguards and this isn't a breach for us. But what if it was? Our customers can literally lose their lives if someone cracks the security and finds a way to remotely open all the locks in their home or business. Don't tell me that some search engine profits or someone's emails history is "more valuable" than 2000 schoolchildren's lives. How about you give copies of the keys to your apartment and a card containing your address to 50 random people on the streets and see if you still feel that having your Gmail account hacked is more valuable.
  - SonOfLilit 3y ago
    Sorry, but that's not a serious risk analysis. The average person would be hurt a lot more by a godaddy breach by a state actor than by a breach of your service by a state actor.
School-Cotton 3y ago
> My customers and business are not any less important or valuable than anyone else's Of course they are. If Red Hat has a million times more customers than you do then they are collectively more valuable almost by definition.
- InvertedRhodium 3y ago
  If OP is managing something that is critical to life - think fire suppression controllers, or computers that are connected to medical equipment, I think it becomes very difficult to compare that against financial assets.
  - solarengineer 3y ago
    I can think of two approaches for such companies: a. Use commercial OS vendors who will push out fixes. b. Set up a Continuous Integration process where everything is open source and is built from the ground up, with some reliance on open source platforms such as distros. One needs different types of competence and IT Operational readiness in each approach.
    - squeaky-clean 3y ago
      > b. Set up a Continuous Integration process where everything is open source and is built from the ground up, with some reliance on open source platforms such as distros. How would that have prevented this backdoor?
  - jen20 3y ago
    Such systems should be airgapped…
  - ajdlinux 3y ago
    At a certain scale, "economic" systems become critical to life. Someone who has sufficiently compromised a systemically-important bank can do things that would result in riots breaking out on the street all over a country.
  - 3y ago
voidfunc 3y ago
> My customers and business are not any less important or valuable than anyone else's Hate to break it to you but yes they are.

hulitu 3y ago

> but to the users of the software to finish updating their systems to a new fixed release, Is there "a new fixed release" ?