3 ms·

The reporter took time to check and mention on their website specific distributions Ubuntu/RHEL/SUSE. One would have thought reporting to security teams of at l

The reporter took time to check and mention on their website specific distributions Ubuntu/RHEL/SUSE. One would have thought reporting to security teams of at least those would be responsible.

semiquaver 6mo ago
“One” would have thought? Can you point to a written policy that says that’s how it should be?
- anikom15 6mo ago
  The tenets of decency don’t need to be written down.
  - tob_scott_a 6mo ago
    If you can't write it down, why would you expect it to be universal and enforceable? Different cultures exist and have different opinions on what "decency' means, after all. A security researcher's ethical obligations are to protect users over vendors (barring any contractual agreement in place). From what has been discussed in this thread, they meet that bar. Sure, they could have gone the extra mile to ensure the distros were in a good place to patch before they published the exploit. That's a kindness you can wish for, but don't disparage them for not going that extra mile. It's a bonus. It's also possible that it simply didn't occur to them to do so this time. There's certainly lessons to be learned either way. I don't know that the right lessons will emerge from hostility.
    - Quarrelsome 6mo ago
      > If you can't write it down, why would you expect it to be universal and enforceable? and this is the problem. It used to be the case that if you were smart enough to find an exploit you were also smart enough to realise what would happen if you irresponsibly disclosed it. I guess these tools have made that pattern no longer apply.
      - true_religion 6mo ago
        From my point of view, they told the kernel security team which is in charge of fixing this. If it’s important for them to tell other people, then it should’ve been written down and further reiterated when they made their report. The skills to detect code exploits is not the same as the skills to navigate an informal org chart to the satisfaction of an amorphous audience if end users (i.e. us on HN). That said… as they are a company that supposedly specializes in this field, and is trying to sell a product, I do believe they should do better. Right now, I don’t have much confidence in their product.
    - scragz 6mo ago
      different cultures have different views on disclosing vulnerabilities to distros before the public?
      - embedding-shape 6mo ago
        Yes :) The blackhatter would obviously sit on it until they can sell it or use it, the whitehatter collaborate the kernel and distros to patch, and the greyhatter argues on HN whether the latest *fail was responsible enough or not.
      - sunshowers 6mo ago
        Yes? "Different cultures" doesn't just mean different countries; there are many cultures within infosec.
    - anikom15 6mo ago
      There is little difference in culture here. Nearly all open source work is done in English.
- happyopossum 6mo ago
  No, nor can I point to a written policy that states one should cover one’s mouth when they cough. Everyone involved here failed to do the right thing, and hiding behind the lack of written words is weak sauce.

The reporter took time to check and mention on their website specific distributions Ubuntu/RHEL/SUSE. One would have thought reporting to security teams of at least those would be responsible.

semiquaver 6mo ago

“One” would have thought? Can you point to a written policy that says that’s how it should be?

anikom15 6mo ago
The tenets of decency don’t need to be written down.
- tob_scott_a 6mo ago
  If you can't write it down, why would you expect it to be universal and enforceable? Different cultures exist and have different opinions on what "decency' means, after all. A security researcher's ethical obligations are to protect users over vendors (barring any contractual agreement in place). From what has been discussed in this thread, they meet that bar. Sure, they could have gone the extra mile to ensure the distros were in a good place to patch before they published the exploit. That's a kindness you can wish for, but don't disparage them for not going that extra mile. It's a bonus. It's also possible that it simply didn't occur to them to do so this time. There's certainly lessons to be learned either way. I don't know that the right lessons will emerge from hostility.
  - Quarrelsome 6mo ago
    > If you can't write it down, why would you expect it to be universal and enforceable? and this is the problem. It used to be the case that if you were smart enough to find an exploit you were also smart enough to realise what would happen if you irresponsibly disclosed it. I guess these tools have made that pattern no longer apply.
    - true_religion 6mo ago
      From my point of view, they told the kernel security team which is in charge of fixing this. If it’s important for them to tell other people, then it should’ve been written down and further reiterated when they made their report. The skills to detect code exploits is not the same as the skills to navigate an informal org chart to the satisfaction of an amorphous audience if end users (i.e. us on HN). That said… as they are a company that supposedly specializes in this field, and is trying to sell a product, I do believe they should do better. Right now, I don’t have much confidence in their product.
  - scragz 6mo ago
    different cultures have different views on disclosing vulnerabilities to distros before the public?
    - embedding-shape 6mo ago
      Yes :) The blackhatter would obviously sit on it until they can sell it or use it, the whitehatter collaborate the kernel and distros to patch, and the greyhatter argues on HN whether the latest *fail was responsible enough or not.
    - sunshowers 6mo ago
      Yes? "Different cultures" doesn't just mean different countries; there are many cultures within infosec.
  - anikom15 6mo ago
    There is little difference in culture here. Nearly all open source work is done in English.
happyopossum 6mo ago
No, nor can I point to a written policy that states one should cover one’s mouth when they cough. Everyone involved here failed to do the right thing, and hiding behind the lack of written words is weak sauce.