5 ms·
The disclosure was more about marketing than security. From the disclosure page: > Is your software AI-era safe? > Copy Fail was surfaced by Xint Code about a
by zamalek 6mo ago
The disclosure was more about marketing than security. From the disclosure page:
> Is your software AI-era safe?
> Copy Fail was surfaced by Xint Code about an hour of scan time against the Linux crypto/ subsystem. [...]
> [Try Xint Code]
More chaos makes their product seem even more attractive.
- esseph 6mo agoYour advertising for them on HN would help them too, I bet.
- jasonmp85 6mo agoDoes it? Now that I see their name again in this context they're blacklisted for life.
- CSSer 6mo agoYes, exactly. Name and shame.
- true_religion 6mo agoSame. I did not know who they were, but now they have been named and shamed. Not every publicity is good.
- Scharkenberg 6mo agoIt is the opposite for me. I did not know who they are and now I have a positive opinion of them.
- selectively 6mo agoResearchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit. Just fyi. Be glad it was disclosed at all. Be glad a patch was available prior to release.
- lambda 6mo agoIf they want to be seen as responsible rather than opportunistic, then yeah, they should do a proper coordinated disclosure. Sure, they have no legal obligation to disclose, but we all also have no legal obligation to buy their services. Blacklisting bad actors like this is the right move to discourage this kind of behavior.
- selectively 6mo agoWho cares about how you are seen when you are selling 0day for big bucks? The bad actor makes more money than the 'legitimate' one without breaking any law. Punishing someone who didn't alert distros despite a patch being available encourages the company to simply find flaws and sell them for profit - it pays more to begin with.
- dirasieb 6mo agoit’s called building and preserving a high trust society, you wouldn’t understand
- DaSHacka 6mo agoHow does someone being incentivized to sell a vulnerability to a private organization over disclosing it publicly preserve a "high trust society"? Do you mean in the context of a "deceptively high-trust society"? Those private actors aren't planning to sit around and hold onto these exploits they've horded forevermore, they're obviously paying for them so they can one day use them.
- _yttw 6mo agoIf they want to take advantage of disclosure for marketing, they're either going to need to accept the norms around responsible disclosure, or they're going to need to accept how shirking those norms will come off. That's life in society. Sometimes it's annoying and sometimes it doesn't feel rational, but these norms have been negotiated throughout the history of our industry and are the way they are for reasons good and bad. I just don't see the point in complaining about how shirking the norms of your industry will make you look irresponsible. I don't really care that they could have decided to sell the vulnerability instead. It isn't material.
- eaf7e281 6mo agoSame. They do become famous, but not in a wholly positive way.
- esseph 6mo agoI used to think the context of the fame mattered. At least in the US, it does not. Hell, Crowdstrike is still purchased.
- john_strinlai 6mo agohope you are also blacklisting google's project zero, and practically every other major player in the vulnerability reporting space, as all use roughly the same bog standard 90+30 policy. this was a failure of the kernel security team, and their stance on communicating security issues with their downstreams.
- bathtub365 6mo agoWhat are they blacklisted from exactly? The benefit you get from them forcing vendors to make their software more secure?
- tptacek 6mo agoI worked at the industry's first commercial vulnerability lab (Secure Networks) in the mid-90s, and many of my friends at the time founded X-Force. Commercial vulnerability research has always been about marketing: marketing pays for the vulnerability research. That doesn't make it any less prosocial.
- bathtub365 6mo agoTo be clear, the vulnerability existed in Linux, not in Xint Code. It existed whether this group disclosed it or not. Knowledge of it and exploits may have already been bought and sold among various groups with various motives including crime, terrorism, or cyberwarfare who likely made good money off it if this happened. In that world, the vulnerability has more value to those who seek to exploit it for their own motives, regardless of the consequences. They hope that no one else stumbles on it and fixes it, preventing them from continuing to use it to do bad things. In the world where it is disclosed, there is more value in fixing the vulnerability as the maintainer’s reputation is at risk (and potentially monetary loss or legal liability if they are shown to be negligent).
- zamalek 6mo agoYes, and that's why we have the responsible disclosure protocol. It wasn't correctly followed here.
- tptacek 6mo agoThere is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)
- zamalek 6mo agohttps://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... > In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) I guess you can learn something new after 36 years. If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now that we are firmly in worthless pedantry: Protocol (n): 1.a. a system of rules that explain the correct conduct and procedures to be followed in formal situations 1.b. a set of conventions governing the treatment and especially the formatting of data in an electronic communications system If you don't like what I said or disagree, poke holes in factual inaccuracies. However, in the reality that I am pretty sure we all share, responsible disclosure is a well established protocol that is followed by many security researchers, and was imperfectly followed here.
- ramon156 6mo agoI created an account for xint code, wtf is this UX? I get put into a read-only dashboard with ZERO info. is this live? is this static? how do I use it? the API button just leads me to a swagger doc.