3 ms·

"Responsible" disclosure at best results in an embargo where "trusted" parties get to sit on it while the general public remains at risk. Worst case you get the

by DanAtC 2y ago

"Responsible" disclosure at best results in an embargo where "trusted" parties get to sit on it while the general public remains at risk. Worst case you get the cops knocking at your door. (Full disclosure should be done anonymously to prevent the latter from happening anyway)

afavour 2y ago
But full disclosure places the general public at greater risk than responsible disclosure.
- michaelt 2y ago
  Let's say hypothetically someone found this hacked website, sent an e-mail to the site owners' security reporting contact, and after a year they hadn't taken any action. Some would say a "responsible" disclosure which allows the danger to continue unabated for a year is a greater danger than a public disclosure, which would lead to the danger being fixed.
  - afavour 2y ago
    That is one hypothetical scenario, yes. Another hypothetical scenario is that as a result of responsible disclosure the site owners patch the hole and ensure customer data isn't publicly accessible before the vulnerability is public knowledge. Seems reckless to me to not even _try_ responsible disclosure. You don't have to wait a year. But at least give a chance for the problem to be solved before you make it common knowledge.
    - michaelt 2y ago
      Did I say hypothetically? Sorry, I meant to say exactly as happened [1] :) [1] https://news.ycombinator.com/item?id=40169334 https://news.ycombinator.com/item?id=40169334
      - afavour 2y ago
        Right, so that’s a dataset of 1. Are you suggesting responsible disclosure never works because of your one time experience?
        michaelt 2y ago
        Of course not. I agree that responsible disclosure works perhaps 10% of the time. It's the 90% of the time, when it doesn't work, that's the problem.
- lynx23 2y ago
  Only in the very short term. In mid-to-long term it increases the incentive to actually roll out a fix sooner then later.
  - busterarm 2y ago
    Or you can possibly decide to shut down whatever service is vulnerable.

by DanAtC 2y ago

afavour 2y ago

But full disclosure places the general public at greater risk than responsible disclosure.

michaelt 2y ago
Let's say hypothetically someone found this hacked website, sent an e-mail to the site owners' security reporting contact, and after a year they hadn't taken any action. Some would say a "responsible" disclosure which allows the danger to continue unabated for a year is a greater danger than a public disclosure, which would lead to the danger being fixed.
- afavour 2y ago
  That is one hypothetical scenario, yes. Another hypothetical scenario is that as a result of responsible disclosure the site owners patch the hole and ensure customer data isn't publicly accessible before the vulnerability is public knowledge. Seems reckless to me to not even _try_ responsible disclosure. You don't have to wait a year. But at least give a chance for the problem to be solved before you make it common knowledge.
  - michaelt 2y ago
    Did I say hypothetically? Sorry, I meant to say exactly as happened [1] :) [1] https://news.ycombinator.com/item?id=40169334 https://news.ycombinator.com/item?id=40169334
    - afavour 2y ago
      Right, so that’s a dataset of 1. Are you suggesting responsible disclosure never works because of your one time experience?
      - michaelt 2y ago
        Of course not. I agree that responsible disclosure works perhaps 10% of the time. It's the 90% of the time, when it doesn't work, that's the problem.
lynx23 2y ago
Only in the very short term. In mid-to-long term it increases the incentive to actually roll out a fix sooner then later.
- busterarm 2y ago
  Or you can possibly decide to shut down whatever service is vulnerable.