6 ms·

To be clear, the vulnerability existed in Linux, not in Xint Code. It existed whether this group disclosed it or not. Knowledge of it and exploits may have alre

To be clear, the vulnerability existed in Linux, not in Xint Code. It existed whether this group disclosed it or not. Knowledge of it and exploits may have already been bought and sold among various groups with various motives including crime, terrorism, or cyberwarfare who likely made good money off it if this happened. In that world, the vulnerability has more value to those who seek to exploit it for their own motives, regardless of the consequences. They hope that no one else stumbles on it and fixes it, preventing them from continuing to use it to do bad things. In the world where it is disclosed, there is more value in fixing the vulnerability as the maintainer’s reputation is at risk (and potentially monetary loss or legal liability if they are shown to be negligent).

zamalek 6mo ago
Yes, and that's why we have the responsible disclosure protocol. It wasn't correctly followed here.
- tptacek 6mo ago
  There is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)
  - zamalek 6mo ago
    https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... > In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) I guess you can learn something new after 36 years. If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now that we are firmly in worthless pedantry: Protocol (n): 1.a. a system of rules that explain the correct conduct and procedures to be followed in formal situations 1.b. a set of conventions governing the treatment and especially the formatting of data in an electronic communications system If you don't like what I said or disagree, poke holes in factual inaccuracies. However, in the reality that I am pretty sure we all share, responsible disclosure is a well established protocol that is followed by many security researchers, and was imperfectly followed here.
    - voxic11 6mo ago
      What rules were not followed here?
      - zamalek 6mo ago
        Tons of distros were not informed.
        akerl_ 6mo ago
        Is that a rule? Are there rules? These researchers found a vulnerability in the Linux kernel. They could have just written a blog post and put it online, or not told anybody, or sold it. But instead they decided to tell the Linux kernel devs, and give them time to act before publishing. And your beef is that you’ve decided they needed to also inform individual downstream projects that use the Linux kernel? Why? Which ones?
        zamalek 6mo ago
        > Is that a rule? No, it's commonly followed practice: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... I'm all for lighting a fire under the developer's ass, but we live in an imperfect world and the biggest problem that we have is end-users. We may have applied the mitigation on day 0, and updated as soon as the kernel landed in our distro - and if some of us didn't then we've even got savvy users in that "don't update fast enough group" (which is fine, which is human, but is said imperfection). Major distros should at least have gotten a few days of notice for something this catastrophic. It doesn't help that the kernel is fixed if "normies" aren't able to access it on day 0. For reference, the standard is 30 for the developer to fix and 90 for it to land on machines. Even 30+7 would have been a substantial improvement. Ethical security research involves ethics, and maybe they aren't referenced in university/college any more - but here's what I was taught: https://www.acm.org/code-of-ethics https://www.acm.org/code-of-ethics . > 1.1 Contribute to society and to human well-being, acknowledging that all people are stakeholders in computing. > [...] Computing professionals should consider whether the results of their efforts will [...] and will be broadly accessible. > 1.2 Avoid harm. > (Honestly, all of it) > 2.3 Know and respect existing rules pertaining to professional work. > 3.1 Ensure that the public good is the central concern during all professional computing work. > People—including users, customers, colleagues, and others affected directly or indirectly—should always be the central concern in computing. Maybe other code of ethics for CS exist; I'd like to know which ethics these ethical researchers were following.
- Scharkenberg 6mo ago
  Which part was not correctly followed?

zamalek 6mo ago

Yes, and that's why we have the responsible disclosure protocol. It wasn't correctly followed here.

tptacek 6mo ago
There is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)
- zamalek 6mo ago
  https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... > In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) I guess you can learn something new after 36 years. If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now that we are firmly in worthless pedantry: Protocol (n): 1.a. a system of rules that explain the correct conduct and procedures to be followed in formal situations 1.b. a set of conventions governing the treatment and especially the formatting of data in an electronic communications system If you don't like what I said or disagree, poke holes in factual inaccuracies. However, in the reality that I am pretty sure we all share, responsible disclosure is a well established protocol that is followed by many security researchers, and was imperfectly followed here.
  - voxic11 6mo ago
    What rules were not followed here?
    - zamalek 6mo ago
      Tons of distros were not informed.
      - akerl_ 6mo ago
        Is that a rule? Are there rules? These researchers found a vulnerability in the Linux kernel. They could have just written a blog post and put it online, or not told anybody, or sold it. But instead they decided to tell the Linux kernel devs, and give them time to act before publishing. And your beef is that you’ve decided they needed to also inform individual downstream projects that use the Linux kernel? Why? Which ones?
        zamalek 6mo ago
        > Is that a rule? No, it's commonly followed practice: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... I'm all for lighting a fire under the developer's ass, but we live in an imperfect world and the biggest problem that we have is end-users. We may have applied the mitigation on day 0, and updated as soon as the kernel landed in our distro - and if some of us didn't then we've even got savvy users in that "don't update fast enough group" (which is fine, which is human, but is said imperfection). Major distros should at least have gotten a few days of notice for something this catastrophic. It doesn't help that the kernel is fixed if "normies" aren't able to access it on day 0. For reference, the standard is 30 for the developer to fix and 90 for it to land on machines. Even 30+7 would have been a substantial improvement. Ethical security research involves ethics, and maybe they aren't referenced in university/college any more - but here's what I was taught: https://www.acm.org/code-of-ethics https://www.acm.org/code-of-ethics . > 1.1 Contribute to society and to human well-being, acknowledging that all people are stakeholders in computing. > [...] Computing professionals should consider whether the results of their efforts will [...] and will be broadly accessible. > 1.2 Avoid harm. > (Honestly, all of it) > 2.3 Know and respect existing rules pertaining to professional work. > 3.1 Ensure that the public good is the central concern during all professional computing work. > People—including users, customers, colleagues, and others affected directly or indirectly—should always be the central concern in computing. Maybe other code of ethics for CS exist; I'd like to know which ethics these ethical researchers were following.
Scharkenberg 6mo ago
Which part was not correctly followed?