10 ms·

Responsible Disclosures and their consequences have been a disaster for the human race. Companies need to feel a lot more pain a lot more often in order for the

Responsible Disclosures and their consequences have been a disaster for the human race. Companies need to feel a lot more pain a lot more often in order for them to take the security of their customers a lot more serious. If you just give them month to fix an issue and spoon-feed them the solution it's just another ticket in their Backlog. But if every other security issue becomes enough news online that their CEOs are involved and a solution must be find in hours not month, they will become a lot more proactive. Of course it's the end users that would suffer most from this. But then again, they buy ASUS so they suffer already...

okanat 1y ago
Citing CGPGrey: Solutions that are the first thing you can think of are terrible and ineffective. Good safety/security culture encourages players to not hide their problems. Corporations are greedy bastards. They'll do everything to hide their security mistakes. You are also making legitimate, fixable in a month issues available for everyone which increases their chances to be exploited a lot.
- IlikeKitties 1y ago
  > You are also making legitimate, fixable in a month issues available for everyone which increases their chances to be exploited a lot. I don't think you can fathom the amount of people that have phones with roughly 3 years of no android updates as their primary device with which they use all the digital services they use, Banking, Texting, Doomscrolling, Porn, ... Users, especially the most likely to be exploited are already vulnerable to so much shit and even when there's a literal finished fix available, these vendors do shit about it. Only when their bottomline is threatened because even my mom knows "Don't buy anything with ASUS on it, your bank account gets broken into if you do" will we see change.
  - einsteinx2 1y ago
    I’m not sure that’s a great example as they would be vulnerable to many responsibly disclosed and previously fixed issues anyway since they never update. In fact they would be just as vulnerable to any new responsibly disclosed issues as they would if they were immediately “irresponsibly” disclosed because again, they never update anyway.
  - okanat 1y ago
    > I don't think you can fathom the amount of people that have phones with roughly 3 years of no android updates as their primary device with which they use all the digital services they use, Banking, Texting, Doomscrolling, Porn, ... I do. I'm an embedded software developer in a team that cares about having our software up-to-date a lot. > Users, especially the most likely to be exploited are already vulnerable to so much shit and even when there's a literal finished fix available, these vendors do shit about it. Only when their bottomline is threatened because even my mom knows "Don't buy anything with ASUS on it, your bank account gets broken into if you do" will we see change. Yes individuals are quite exploitable. That's why I really like EU's new regulations Cyber Resiliency Act and new Radio Equipment Directive. When governments enforce reasonable disclosure and fixing timelines, then threaten your company's ability to sell things in a market alltogether, if you don't comply, it works wonders. Companies hate not being able to make money. So all the extra security policies and vulnerability tracking we have been experimenting with and secure-by-default languages are now the highest priority for us. EU regulation makes sure that you're not going to be sold a router that's instantly hackable in a year. It will also force chip manufacturers to have meaningful maintenance windows like 5-10 years due to pressure from ODMs. That's why you're seeing all the smartphone manufacturers have extended support timelines, it is not pure market pressure. They didn't give fuck about it for more than 10 years. When EU came with a big stick though... Spreading word-of-mouth knowledge works until a point. Having your entire product line being banned entering a market works almost every time.
  - layer8 1y ago
    The fact about people running outdated OS versions is totally true, but it also indicates that the risk of being vitally harmed by those vulnerabilities is quite low in reality, if you’re not an individually targeted person. And that’s why not a lot of people care about them.
    - int_19h 1y ago
      In this day and age, you're just as likely to be targeted by a large-scale ransomware operation that just happens to find your vulnerable device by network scanning, for example.
- Avamander 1y ago
  > Good safety/security culture encourages players to not hide their problems. Corporations are greedy bastards. They'll do everything to hide their security mistakes. This is why I despise the Linux CNA for working against the single system that tries to hold vendors accountable. Their behavior is infantile.
holowoodman 1y ago
"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors. The actually responsible thing to do is to disclose immediately, fully and publically (and maybe anonymously to protect yourself). Only after the affected company has repeatedly demonstrated that they do react properly, they might earn the right for a very time-limited heads-up of say 5 work days or something. That irresponsibly delayed limited disclosure is even called "responsible disclosure" is an instance of newspeak.
- IlikeKitties 1y ago
  I mean, to be a bit more reasonable, there's a middle ground here. Maybe disclosing a massive RCE Vulnerability in software used by a lot of companies on 25th of December is not a good Idea. And perhaps an Open Source Dev with a security@project mail deserves a tad more help and patience than a megacorp with a record of shitty security management. And if you are a company that takes security serious and is responsive to security researchers inquiries they deserve at least the chance to fix it fast and before it becomes public. It's just that there are some companies EVERYONE knows are shitty. ASUS is one of them.
  - holowoodman 1y ago
    You are right about open source developers who do this on the side, as a hobby, and even if they don't are usually underpaid and understaffed. They do deserve more time and a different approach. But corporations making big bucks from their software need to be able to fix things quickly. They took money for their software, so it is their responsibility. If they cannot react on a public holiday, tough luck. Just look at their payment terms. Do they want their money within 30 days or 25 work days? Usually it is the former, they don't care about your holidays, so why should anyone care about theirs? Also, the bad guys don't care about their victims' holidays. You are just giving them extra time to exploit. The only valid argument would be that the victims might not be reading the news about your disclosure on a holiday. But since you are again arguing about software used by a lot of companies (as opposed to private users), I don't see a problem there. They also have their guards on duty and their maintenance staff on call for a broken pipe or something. What's most important is that I'm saying we should revert the "benefit of the doubt". A vast majority of corporations have shitty security handling. Even the likes of Google talk big with their 90 day time window from private irresponsible disclosure to public disclosure. And even Google regularly fails to fix things within those 90 days. So the default must be immediate public and full disclosure. Only when companies have proven their worth by correctly reacting to a number of those, then they can be given the "benefit of the doubt" and a heads up. Because otherwise, when the default is irresponsible private disclosure, they will never have any incentive to get better. Their users will always be in danger unknowingly. The market will not have information to decide whether to continue buying from them. The situation will only get worse.
oezi 1y ago
The problem is just one of legislation of liability. Car manufacturers are ordered to recall and fix their cars, but software/hardware companies face just too little pressure. I think customers should be able to get full refund for broken devices (with unfixed CVE for example).
- mjevans 1y ago
  The devices and core functionality (including security updates, which are fixes to broken core functionality) must survive the manufacturer and should not require ongoing payments of any type*. (new updates being created? maybe, access to corrections to basic behavior? Bug / security fixes should remain free.)
  - oezi 1y ago
    Yes. I would envision that it is at least 5 years of such updates fixes and another 5 years available for purchase capped at 20% of device price. All manufacturers must pay an annual fee to an insurance scheme which covers the case of insolvency of manufacturers.
curiousgal 1y ago
> a disaster for the human race. This is a prime example where a hyperbole completely obliterates the point one is trying to make.
- IlikeKitties 1y ago
  > This is a prime example where a hyperbole completely obliterates the point one is trying to make. This is a prime example of someone not getting the joke everyone else got. [0] [0] https://www.washingtonpost.com/wp-srv/national/longterm/unabomber/manifesto.text.htm https://www.washingtonpost.com/wp-srv/national/longterm/unab...
hamandcheese 1y ago
Business idea. Maybe this already exists. A disclosure aggregator/middle man which: - protects the privacy of folks submitting - vets security vulns. Everything they disclose is exploitable. - publishes disclosures publicly at a fixed cadence. - allows companies to pay to subscribe to an "early feed" of disclosures which impact them. This money is used to reward those submitting disclosures, pay the bills, and take some profit. A bug bounty marketplace, if you will. That is slightly hostile to corporations. Would that be legal, or extortion?
- darkwater 1y ago
  Isn't that basically HackerOne?
  - xmodem 1y ago
    HackerOne, BugCrowd, et al don't appear to make any serious effort to vet reports themselves.
    - hashstring 1y ago
      Is that true? I thought you could pay for a H1 service that basically had professionals triaging the vulnerabilities and only pass on the correct ones?
      - ycombinatrix 1y ago
        Our company pays for one of these third party triage services for H1. The quality is seriously lacking. They have dismissed many valid findings.
        hashstring 1y ago
        Ah thank you for the info! From what I understood, the service is also (very) expensive. Wild.
  - Avamander 1y ago
pjmlp 1y ago
As I keep saying, liability like in any other industry. Most folks don't put up with faulty products unless by decision, like those 1 euro/dollar shops, so why should software get a pass.
jeroenhd 1y ago
I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones that haven't received updates in three years to do their finances. If you spam the news with CVEs, people will just get tired of hearing about how every company sucks and become apathetic once there's a real threat. The EU is working on a different solution. Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations. That means if ASUS keeps fucking up, their motherboards become dead stock and stores won't want to sell their hardware anymore. That's not just computer hardware, but also smart fridges and smart washing machines. Discover a vulnerability in your dish washer and you may end up costing the dish washer industry millions in unusable stock if their vendors haven't bothered to add a way to update the firmware.
- buzer 1y ago
  > Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations. What are the specifics on that? Like does the vulnerability need to be public or is it enough if just the vendor knows about it? Does everyone need to stop selling it right away if new vulnerability is discovered or do they some time patch it? I'm pretty sure software like Windows almost definitely has some unfixed vulnerabilities that Microsoft knows about and is in process of fixing every single day of the year. Currently even if they do have a fix, they would end up postponing it until next patch Tuesday. And what even is "vulnerability" in this context? Remote RCE? DRM bypass?
  - chillax 1y ago
    Probably refering to CRA - Cyber Resilience Act https://schjodt.com/news/the-cyber-resilience-act-enters-into-force-in-the-eu-key-takeaways-for-manufacturers-and-retailers-of-connected-products https://schjodt.com/news/the-cyber-resilience-act-enters-int... https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act https://digital-strategy.ec.europa.eu/en/policies/cyber-resi... https://ec.europa.eu/commission/presscorner/detail/en/qanda_22_5375 https://ec.europa.eu/commission/presscorner/detail/en/qanda_...
fulafel 1y ago
Or we could just have regulation or at least the same product liability for software as everything else.
lofaszvanitt 1y ago
Just post it next day, when found. That will be the proper incentive and losing face also contributes to better security next time.
deleted 1y ago
[deleted]
throwaway984393 1y ago
[dead]

okanat 1y ago

Citing CGPGrey: Solutions that are the first thing you can think of are terrible and ineffective. Good safety/security culture encourages players to not hide their problems. Corporations are greedy bastards. They'll do everything to hide their security mistakes. You are also making legitimate, fixable in a month issues available for everyone which increases their chances to be exploited a lot.

IlikeKitties 1y ago
> You are also making legitimate, fixable in a month issues available for everyone which increases their chances to be exploited a lot. I don't think you can fathom the amount of people that have phones with roughly 3 years of no android updates as their primary device with which they use all the digital services they use, Banking, Texting, Doomscrolling, Porn, ... Users, especially the most likely to be exploited are already vulnerable to so much shit and even when there's a literal finished fix available, these vendors do shit about it. Only when their bottomline is threatened because even my mom knows "Don't buy anything with ASUS on it, your bank account gets broken into if you do" will we see change.
- einsteinx2 1y ago
  I’m not sure that’s a great example as they would be vulnerable to many responsibly disclosed and previously fixed issues anyway since they never update. In fact they would be just as vulnerable to any new responsibly disclosed issues as they would if they were immediately “irresponsibly” disclosed because again, they never update anyway.
- okanat 1y ago
  > I don't think you can fathom the amount of people that have phones with roughly 3 years of no android updates as their primary device with which they use all the digital services they use, Banking, Texting, Doomscrolling, Porn, ... I do. I'm an embedded software developer in a team that cares about having our software up-to-date a lot. > Users, especially the most likely to be exploited are already vulnerable to so much shit and even when there's a literal finished fix available, these vendors do shit about it. Only when their bottomline is threatened because even my mom knows "Don't buy anything with ASUS on it, your bank account gets broken into if you do" will we see change. Yes individuals are quite exploitable. That's why I really like EU's new regulations Cyber Resiliency Act and new Radio Equipment Directive. When governments enforce reasonable disclosure and fixing timelines, then threaten your company's ability to sell things in a market alltogether, if you don't comply, it works wonders. Companies hate not being able to make money. So all the extra security policies and vulnerability tracking we have been experimenting with and secure-by-default languages are now the highest priority for us. EU regulation makes sure that you're not going to be sold a router that's instantly hackable in a year. It will also force chip manufacturers to have meaningful maintenance windows like 5-10 years due to pressure from ODMs. That's why you're seeing all the smartphone manufacturers have extended support timelines, it is not pure market pressure. They didn't give fuck about it for more than 10 years. When EU came with a big stick though... Spreading word-of-mouth knowledge works until a point. Having your entire product line being banned entering a market works almost every time.
- layer8 1y ago
  The fact about people running outdated OS versions is totally true, but it also indicates that the risk of being vitally harmed by those vulnerabilities is quite low in reality, if you’re not an individually targeted person. And that’s why not a lot of people care about them.
  - int_19h 1y ago
    In this day and age, you're just as likely to be targeted by a large-scale ransomware operation that just happens to find your vulnerable device by network scanning, for example.
Avamander 1y ago
> Good safety/security culture encourages players to not hide their problems. Corporations are greedy bastards. They'll do everything to hide their security mistakes. This is why I despise the Linux CNA for working against the single system that tries to hold vendors accountable. Their behavior is infantile.

holowoodman 1y ago

"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors. The actually responsible thing to do is to disclose immediately, fully and publically (and maybe anonymously to protect yourself). Only after the affected company has repeatedly demonstrated that they do react properly, they might earn the right for a very time-limited heads-up of say 5 work days or something. That irresponsibly delayed limited disclosure is even called "responsible disclosure" is an instance of newspeak.

IlikeKitties 1y ago
I mean, to be a bit more reasonable, there's a middle ground here. Maybe disclosing a massive RCE Vulnerability in software used by a lot of companies on 25th of December is not a good Idea. And perhaps an Open Source Dev with a security@project mail deserves a tad more help and patience than a megacorp with a record of shitty security management. And if you are a company that takes security serious and is responsive to security researchers inquiries they deserve at least the chance to fix it fast and before it becomes public. It's just that there are some companies EVERYONE knows are shitty. ASUS is one of them.
- holowoodman 1y ago
  You are right about open source developers who do this on the side, as a hobby, and even if they don't are usually underpaid and understaffed. They do deserve more time and a different approach. But corporations making big bucks from their software need to be able to fix things quickly. They took money for their software, so it is their responsibility. If they cannot react on a public holiday, tough luck. Just look at their payment terms. Do they want their money within 30 days or 25 work days? Usually it is the former, they don't care about your holidays, so why should anyone care about theirs? Also, the bad guys don't care about their victims' holidays. You are just giving them extra time to exploit. The only valid argument would be that the victims might not be reading the news about your disclosure on a holiday. But since you are again arguing about software used by a lot of companies (as opposed to private users), I don't see a problem there. They also have their guards on duty and their maintenance staff on call for a broken pipe or something. What's most important is that I'm saying we should revert the "benefit of the doubt". A vast majority of corporations have shitty security handling. Even the likes of Google talk big with their 90 day time window from private irresponsible disclosure to public disclosure. And even Google regularly fails to fix things within those 90 days. So the default must be immediate public and full disclosure. Only when companies have proven their worth by correctly reacting to a number of those, then they can be given the "benefit of the doubt" and a heads up. Because otherwise, when the default is irresponsible private disclosure, they will never have any incentive to get better. Their users will always be in danger unknowingly. The market will not have information to decide whether to continue buying from them. The situation will only get worse.

oezi 1y ago

The problem is just one of legislation of liability. Car manufacturers are ordered to recall and fix their cars, but software/hardware companies face just too little pressure. I think customers should be able to get full refund for broken devices (with unfixed CVE for example).

mjevans 1y ago
The devices and core functionality (including security updates, which are fixes to broken core functionality) must survive the manufacturer and should not require ongoing payments of any type*. (new updates being created? maybe, access to corrections to basic behavior? Bug / security fixes should remain free.)
- oezi 1y ago
  Yes. I would envision that it is at least 5 years of such updates fixes and another 5 years available for purchase capped at 20% of device price. All manufacturers must pay an annual fee to an insurance scheme which covers the case of insolvency of manufacturers.

curiousgal 1y ago

> a disaster for the human race. This is a prime example where a hyperbole completely obliterates the point one is trying to make.

IlikeKitties 1y ago
> This is a prime example where a hyperbole completely obliterates the point one is trying to make. This is a prime example of someone not getting the joke everyone else got. [0] [0] https://www.washingtonpost.com/wp-srv/national/longterm/unabomber/manifesto.text.htm https://www.washingtonpost.com/wp-srv/national/longterm/unab...

hamandcheese 1y ago

Business idea. Maybe this already exists. A disclosure aggregator/middle man which: - protects the privacy of folks submitting - vets security vulns. Everything they disclose is exploitable. - publishes disclosures publicly at a fixed cadence. - allows companies to pay to subscribe to an "early feed" of disclosures which impact them. This money is used to reward those submitting disclosures, pay the bills, and take some profit. A bug bounty marketplace, if you will. That is slightly hostile to corporations. Would that be legal, or extortion?

darkwater 1y ago
Isn't that basically HackerOne?
- xmodem 1y ago
  HackerOne, BugCrowd, et al don't appear to make any serious effort to vet reports themselves.
  - hashstring 1y ago
    Is that true? I thought you could pay for a H1 service that basically had professionals triaging the vulnerabilities and only pass on the correct ones?
    - ycombinatrix 1y ago
      Our company pays for one of these third party triage services for H1. The quality is seriously lacking. They have dismissed many valid findings.
      - hashstring 1y ago
        Ah thank you for the info! From what I understood, the service is also (very) expensive. Wild.
- Avamander 1y ago

pjmlp 1y ago

As I keep saying, liability like in any other industry. Most folks don't put up with faulty products unless by decision, like those 1 euro/dollar shops, so why should software get a pass.

jeroenhd 1y ago

I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones that haven't received updates in three years to do their finances. If you spam the news with CVEs, people will just get tired of hearing about how every company sucks and become apathetic once there's a real threat. The EU is working on a different solution. Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations. That means if ASUS keeps fucking up, their motherboards become dead stock and stores won't want to sell their hardware anymore. That's not just computer hardware, but also smart fridges and smart washing machines. Discover a vulnerability in your dish washer and you may end up costing the dish washer industry millions in unusable stock if their vendors haven't bothered to add a way to update the firmware.

buzer 1y ago
> Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations. What are the specifics on that? Like does the vulnerability need to be public or is it enough if just the vendor knows about it? Does everyone need to stop selling it right away if new vulnerability is discovered or do they some time patch it? I'm pretty sure software like Windows almost definitely has some unfixed vulnerabilities that Microsoft knows about and is in process of fixing every single day of the year. Currently even if they do have a fix, they would end up postponing it until next patch Tuesday. And what even is "vulnerability" in this context? Remote RCE? DRM bypass?
- chillax 1y ago
  Probably refering to CRA - Cyber Resilience Act https://schjodt.com/news/the-cyber-resilience-act-enters-into-force-in-the-eu-key-takeaways-for-manufacturers-and-retailers-of-connected-products https://schjodt.com/news/the-cyber-resilience-act-enters-int... https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act https://digital-strategy.ec.europa.eu/en/policies/cyber-resi... https://ec.europa.eu/commission/presscorner/detail/en/qanda_22_5375 https://ec.europa.eu/commission/presscorner/detail/en/qanda_...

fulafel 1y ago

Or we could just have regulation or at least the same product liability for software as everything else.

lofaszvanitt 1y ago

Just post it next day, when found. That will be the proper incentive and losing face also contributes to better security next time.

deleted 1y ago

[deleted]

throwaway984393 1y ago

[dead]