4 ms·

You’re conflating power and proper practice. “Yeah, well, they’re allowed to” is a comment that’s never, ever worth making, because EVERYONE already knows it. T

You’re conflating power and proper practice. “Yeah, well, they’re allowed to” is a comment that’s never, ever worth making, because EVERYONE already knows it. The need to always kick up a fuss about “doing whatever I want in my land” always feels like a weirdly American reflex that’s always a little ignorant of the context of the actual discussion taking place.

axoltl 2y ago
You're making it sound like there is a well-agreed-upon way of disclosing vulnerabilities ("_proper_ practice"). I'm a security researcher and this particular discussion has been going on for well over a decade at this point. My point wasn't "they're allowed to do whatever they want". My point was there are many different viewpoints on the matter and Canonical seems to be insisting theirs is the correct one. (Also, I'm not American)
- close04 2y ago
  Canonical's statement hits all the right notes. It's a short summary of what coordinated disclosure is and a gentle reminder of why it's important to follow that practice, without really pointing any fingers. I don't see something in Canonical's actions that suggests they actively harmed the process, or that the way the early disclosure was handled was in the users' interest. You say it "rubs you the wrong way" without pointing out what exactly you think is wrong with it. One could easily understand that as a security researcher you just want to do whatever you want, when you want it, without anyone pointing fingers at you. Your attitude that "That power rests solely with the researcher, and they can do as they see fit" while technically correct exudes bad faith. Further explanation that "there's no consensus" isn't making it any better.
  - axoltl 2y ago
    I want to clarify that I think that everyone involved wants to do the "Right Thing". What I'm arguing about is that there are different schools of thought in the vulnerability research community as to what the "Right Thing" is at any given point in time. I am not claiming that a security researcher can just drop 0day on Twitter and not expect some amount of backlash. > You say it "rubs you the wrong way" without pointing out what exactly you think is wrong with it. Let's step through it: >> "Vulnerabilities are normally discussed..." This implies there's a "correct" way of handling vulnerabilities, and anything that doesn't conform to this correct way is the "wrong" way. >> "Sometimes, information can leak and this has the potential to put users at risk." Somewhat of a nothing burger. Information can also potentially help secure users. In my case I immediately shut down the CUPS daemons on all of my boxes. This shortened my exposure window immensely. >> "We encourage everyone to consider the greater good." This reeks of a 'holier than thou' attitude, by implying the disclosure wasn't done with the greater good in mind. I believe evilsocket encountered some headstrong maintainers that had a hard time keeping information about the vulnerabilities secret and assessed the risk of a malicious actor discovering the vulnerability to be too great. The greater good - in the opinion of the security researcher - was better served by ensuring the relevant information was publicly disseminated. >> "If disagreements come up during disclosure, third-party coordinators, such as CERT/CC’s VINCE, can step in to mediate discussion." Disagreements did come up, and Canonical again is subtly claiming they were handled in the "wrong" way as if there is some objective "right" and "wrong" way.
- deleted 2y ago
  [deleted]

axoltl 2y ago

You're making it sound like there is a well-agreed-upon way of disclosing vulnerabilities ("_proper_ practice"). I'm a security researcher and this particular discussion has been going on for well over a decade at this point. My point wasn't "they're allowed to do whatever they want". My point was there are many different viewpoints on the matter and Canonical seems to be insisting theirs is the correct one. (Also, I'm not American)

close04 2y ago
Canonical's statement hits all the right notes. It's a short summary of what coordinated disclosure is and a gentle reminder of why it's important to follow that practice, without really pointing any fingers. I don't see something in Canonical's actions that suggests they actively harmed the process, or that the way the early disclosure was handled was in the users' interest. You say it "rubs you the wrong way" without pointing out what exactly you think is wrong with it. One could easily understand that as a security researcher you just want to do whatever you want, when you want it, without anyone pointing fingers at you. Your attitude that "That power rests solely with the researcher, and they can do as they see fit" while technically correct exudes bad faith. Further explanation that "there's no consensus" isn't making it any better.
- axoltl 2y ago
  I want to clarify that I think that everyone involved wants to do the "Right Thing". What I'm arguing about is that there are different schools of thought in the vulnerability research community as to what the "Right Thing" is at any given point in time. I am not claiming that a security researcher can just drop 0day on Twitter and not expect some amount of backlash. > You say it "rubs you the wrong way" without pointing out what exactly you think is wrong with it. Let's step through it: >> "Vulnerabilities are normally discussed..." This implies there's a "correct" way of handling vulnerabilities, and anything that doesn't conform to this correct way is the "wrong" way. >> "Sometimes, information can leak and this has the potential to put users at risk." Somewhat of a nothing burger. Information can also potentially help secure users. In my case I immediately shut down the CUPS daemons on all of my boxes. This shortened my exposure window immensely. >> "We encourage everyone to consider the greater good." This reeks of a 'holier than thou' attitude, by implying the disclosure wasn't done with the greater good in mind. I believe evilsocket encountered some headstrong maintainers that had a hard time keeping information about the vulnerabilities secret and assessed the risk of a malicious actor discovering the vulnerability to be too great. The greater good - in the opinion of the security researcher - was better served by ensuring the relevant information was publicly disseminated. >> "If disagreements come up during disclosure, third-party coordinators, such as CERT/CC’s VINCE, can step in to mediate discussion." Disagreements did come up, and Canonical again is subtly claiming they were handled in the "wrong" way as if there is some objective "right" and "wrong" way.
deleted 2y ago
[deleted]