3 ms·

> That power rests solely with the researcher, and they can do as they see fit. That's true by definition, but there is still a "right way" and a "wrong way" t

> That power rests solely with the researcher, and they can do as they see fit. That's true by definition, but there is still a "right way" and a "wrong way" to disclose if you don't want people to consider you an asshole. To be clear, not familiar enough to with this situation to say what happened, but I think it's totally fine for Canonical to call this out.

axoltl 2y ago
As a security researcher myself, we've been having the discussion about "right way" and "wrong way" for a long time. The consensus so far is that there is no consensus, and what the "right way" is changes. When Google Project Zero started doing 90 day disclosure deadlines, many viewed this as the wrong way and irresponsible. Now it's viewed as the only way to do disclosures.
- suprjami 2y ago
  > The consensus so far is that there is no consensus, and what the "right way" is changes. Ask your coworkers if the "right way" includes leaking the vuln existence early to hype it up for internet clout, which allows anyone smart to guess the component easily, then breaking your own embargo by publishing a PoC a week earlier than agreed and a week earlier than fixes were supposed to come out. If anyone thinks that's the "right way" then suggest they find a job somewhere else. Preferably not in tech at all.
- hn_throwaway_99 2y ago
  After looking more into what happened, this does not appear to be a case of someone using the wrong fork for the salad course. The fact that good people can debate about the right/optimal disclosure procedures doesn't mean that we shouldn't call out easily identifiable cases of crappy behavior.
  - axoltl 2y ago
    First off, the salad fork expression is going into my repertoire, it is excellent. Second, I will say that evilsocket has a bit of an abrasive and impulsive communication style and that can make for fairly adversarial conversations. Combine that with developers being somewhat defensive around their code/project, and it's a bit of a powder keg waiting to explode. I'm not sure there's anything to take away from this or lessons to be learned other than that creating some mental space/distance is a good thing.
SAI_Peregrinus 2y ago
"Right way" == the implicit duty to the public's safety is followed. For Professional Engineers this duty is explicit in their license. Coordinated disclosure & full disclosure are the usual ways this can happen. "Wrong way" == the duty to the public's safety is violated. Selling exploits to ransomware groups or other criminal organizations is one way this can happen.
bigfatkitten 2y ago
For there to be a "right way" and "wrong way" requires vendors to always do the right thing when notified of a vulnerability, which they sometimes do.

axoltl 2y ago

As a security researcher myself, we've been having the discussion about "right way" and "wrong way" for a long time. The consensus so far is that there is no consensus, and what the "right way" is changes. When Google Project Zero started doing 90 day disclosure deadlines, many viewed this as the wrong way and irresponsible. Now it's viewed as the only way to do disclosures.

suprjami 2y ago
> The consensus so far is that there is no consensus, and what the "right way" is changes. Ask your coworkers if the "right way" includes leaking the vuln existence early to hype it up for internet clout, which allows anyone smart to guess the component easily, then breaking your own embargo by publishing a PoC a week earlier than agreed and a week earlier than fixes were supposed to come out. If anyone thinks that's the "right way" then suggest they find a job somewhere else. Preferably not in tech at all.
hn_throwaway_99 2y ago
After looking more into what happened, this does not appear to be a case of someone using the wrong fork for the salad course. The fact that good people can debate about the right/optimal disclosure procedures doesn't mean that we shouldn't call out easily identifiable cases of crappy behavior.
- axoltl 2y ago
  First off, the salad fork expression is going into my repertoire, it is excellent. Second, I will say that evilsocket has a bit of an abrasive and impulsive communication style and that can make for fairly adversarial conversations. Combine that with developers being somewhat defensive around their code/project, and it's a bit of a powder keg waiting to explode. I'm not sure there's anything to take away from this or lessons to be learned other than that creating some mental space/distance is a good thing.

SAI_Peregrinus 2y ago

"Right way" == the implicit duty to the public's safety is followed. For Professional Engineers this duty is explicit in their license. Coordinated disclosure & full disclosure are the usual ways this can happen. "Wrong way" == the duty to the public's safety is violated. Selling exploits to ransomware groups or other criminal organizations is one way this can happen.

bigfatkitten 2y ago

For there to be a "right way" and "wrong way" requires vendors to always do the right thing when notified of a vulnerability, which they sometimes do.