3 ms·

Giving an author 90 minutes of lead time before public negative press doesn’t count as responsible disclosure. Especially when that press doesn’t mention the s

• yieldcrv 1y ago
  but that wasn't where he disclosed the vulnerability, right? it was in the subsequent one a few weeks later. the first post is erroneous
• tptacek 1y ago
  There's really no such thing as "responsible disclosure", an Orwellian term invented by vendors to create a norm that vendors, and not vulnerability researchers, should set the terms under which vulnerabilities are released. If you need an equivalent term, it's "coordinated disclosure". It's usually best to coordinate disclosure, but not always.
  • dannyobrien 1y ago
    My GOD yes. I spent too much of my life explaining this distinction, not just to vendors, but increasingly to others who think that the vulnerability disclosure model in infosec should be imported to other disciplines (perhaps), but with a little "extra responsibility" (that's not how this was negotiated in infosec, and that's certainly not the way to start exploring the trade-offs in your own area of concern.)
  • Dylan16807 1y ago
    But those aren't the same thing. The basic idea of "responsible disclosure" is that you give the vendor enough time that they could make and deploy a patch. This might involve coordination or it might involve an upfront deadline. "Responsible disclosure" by itself doesn't give the vendor any control. (Unless you're worried about them suing you, but if you're worried about that your whole strategy needs to change far beyond disclosure timing.) If you want a different term that's fine, but I don't agree with framing it as all or nothing or the suggested replacement.
    • akerl_ 1y ago
      Giving the vendor a deadline up front is coordinating with the vendor. You brought them in on a plan for what you’re going to do and asked them to take actions as part of that plan.
      • Dylan16807 1y ago
        Reporting the bug to the vendor is coordinating in a weak sense, but you're not coordinating the disclosure unless they have input in how the disclosure happens. If an email asking them to fix it qualifies as coordinated disclosure, then an immediate public post about the bug is also coordinated disclosure. It also brings them in and asks them to take actions.
        • tptacek 1y ago
          Even "responsible disclosure" didn't necessarily give vendors input into "how" the disclosure happened, only "when".
    • tptacek 1y ago
      There is no basic idea of "responsible disclosure". The term was literally coined so that vendors could call researchers "irresponsible" when they didn't do what the vendors asked. Sometimes immediate disclosure is warranted!
      • Dylan16807 1y ago
        I get it, you don't like that term. But the idea of releasing after a fixed delay is fine. That idea should have a name. We shouldn't imply that releasing after a delay and giving the vendor power over it are the same thing. They should not be lumped together under "coordinated disclosure".
        • tptacek 1y ago
          It does have a name. The name is "coordinated disclosure". Coordinated disclosure isn't an absolute good; it often is, and the name is descriptive of the goal. "Coordinated disclosure" very specifically does not mean "giving the vendor power over it".
• margalabargala 1y ago
  My reading of the article is that they were given a week? 90 minutes was how long it took for the issue to be fixed after the deadline expired and the writeup was published. Arguably this is responsible disclosure deadlines working exactly as intended.