4 ms·

We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible

by meritt 14y ago

We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible disclosure, and any whistle-blowers are immediately branded as "criminals" and "hackers". This whole process, or lack thereof, needs some serious disruption. Edit: My comment is intended to be a general observation and not specifically about this case

batgaijin 14y ago
Disruption by who? Other sovereign entities?
- pbhjpbhj 14y ago
  Perhaps by the state in which a business or other entity is registered. In some states there are strict laws about maintaining privacy of customer data. But, AFAIK, where I am there's nothing specifically addressing negligence in failing to address a security breach that can be called "cracking". Government could, as part of their protection of their citizens offer a service of receiving security notices from third parties and passing them on to registered entities. The government run body could then check - and possibly advise on - the fixing of the [potential] data breach. In the UK the Information Commissioner's Office handle data protection issues (including legislational requirements placed on organisations). They have a form [a .doc, that tells me a lot TBH!] for companies to notify the ICO (http://www.ico.gov.uk/for_organisations/data_protection/lose.aspx http://www.ico.gov.uk/for_organisations/data_protection/lose...); it's not much of a stretch to have a form for third parties but there would need to be legislation to deal with enforcing responses and providing an amnesty for those making [non-malicious] reports.
- rquantz 14y ago
  Perhaps something like wikileaks for internet security? Located outside US jurisdiction?
jebblue 14y ago
>> We live in a tech-filled world without a reliable means for responsible disclosure There are many avenues for responsible disclosure, Google that phrase.
- meritt 14y ago
  I guess that's why companies like Google, Facebook, Mozilla or Microsoft go to great lengths to publicize their disclosure platforms? This endless stream of avenues exist yet these companies feel the need to create their own? Right. CERT-CC is the closest we have and that does little to ensure things are actually resolved nor does it afford any sort of protection to the reporter. Care to link to one of these "many avenues" instead of just pointing me to Google?
- jrockway 14y ago
  As far as I know, following responsible disclosure practices does not waive any legal liability. It may make you look professional, but if someone who is friends with the FBI wants to fuck you, they can still fuck you.
  - tptacek 14y ago
    Following the published disclosure guidelines that Google and Facebook created will in fact prevent the FBI from "fucking you", because any lawyer in the world can read the plain meaning of the statutes point out that a reasonable person would believe they had permission to conduct tests. On the other hand, if you're dealing with an application for which you don't have any written permission to test, just stop. You are not entitled to conduct your own security tests of other people's applications. Leave them alone.
    - meritt 14y ago
      > You are not entitled to conduct your own security tests of other people's applications. Leave them alone. Your attitude is part of the problem and why we need a solution. Let's create an analogy: I drop off my daughter at daycare, I've entrusted this place of business with something vital to me, as have numerous other customers. I get off work early to go pick up my daughter, upon arrival, I find the guardian eating lunch in an adjacent room and the children are left completely unattended. This is clearly a problem on numerous levels. So what do I do? Do I politely inform the administration of the issue and hope they will fix things immediately? What if they blow me off and do not discipline nor change policy? Do I withdraw my child's enrollment and just blindly hope that other customers know of their utter disregard for the trust we've placed in them? Do I report them to the police or child protective services? Do I picket the business and attempt to inform other people of the issues? What if informing the public simultaneously informs some criminals of the ability to do some baby snatching? In this scenario, a parent actually has some legal recourse options to ensure the problem is fixed. The issue in web security is there is no governing authority to report the problem to and if we take our findings public, we place other customer's information at risk and put ourselves in a position of legal risk as well. We get branded a "criminal hacker" and find ourselves off to jail.

by meritt 14y ago

batgaijin 14y ago

Disruption by who? Other sovereign entities?

pbhjpbhj 14y ago
Perhaps by the state in which a business or other entity is registered. In some states there are strict laws about maintaining privacy of customer data. But, AFAIK, where I am there's nothing specifically addressing negligence in failing to address a security breach that can be called "cracking". Government could, as part of their protection of their citizens offer a service of receiving security notices from third parties and passing them on to registered entities. The government run body could then check - and possibly advise on - the fixing of the [potential] data breach. In the UK the Information Commissioner's Office handle data protection issues (including legislational requirements placed on organisations). They have a form [a .doc, that tells me a lot TBH!] for companies to notify the ICO (http://www.ico.gov.uk/for_organisations/data_protection/lose.aspx http://www.ico.gov.uk/for_organisations/data_protection/lose...); it's not much of a stretch to have a form for third parties but there would need to be legislation to deal with enforcing responses and providing an amnesty for those making [non-malicious] reports.
rquantz 14y ago
Perhaps something like wikileaks for internet security? Located outside US jurisdiction?

jebblue 14y ago

>> We live in a tech-filled world without a reliable means for responsible disclosure There are many avenues for responsible disclosure, Google that phrase.

meritt 14y ago
I guess that's why companies like Google, Facebook, Mozilla or Microsoft go to great lengths to publicize their disclosure platforms? This endless stream of avenues exist yet these companies feel the need to create their own? Right. CERT-CC is the closest we have and that does little to ensure things are actually resolved nor does it afford any sort of protection to the reporter. Care to link to one of these "many avenues" instead of just pointing me to Google?
jrockway 14y ago
As far as I know, following responsible disclosure practices does not waive any legal liability. It may make you look professional, but if someone who is friends with the FBI wants to fuck you, they can still fuck you.
- tptacek 14y ago
  Following the published disclosure guidelines that Google and Facebook created will in fact prevent the FBI from "fucking you", because any lawyer in the world can read the plain meaning of the statutes point out that a reasonable person would believe they had permission to conduct tests. On the other hand, if you're dealing with an application for which you don't have any written permission to test, just stop. You are not entitled to conduct your own security tests of other people's applications. Leave them alone.
  - meritt 14y ago
    > You are not entitled to conduct your own security tests of other people's applications. Leave them alone. Your attitude is part of the problem and why we need a solution. Let's create an analogy: I drop off my daughter at daycare, I've entrusted this place of business with something vital to me, as have numerous other customers. I get off work early to go pick up my daughter, upon arrival, I find the guardian eating lunch in an adjacent room and the children are left completely unattended. This is clearly a problem on numerous levels. So what do I do? Do I politely inform the administration of the issue and hope they will fix things immediately? What if they blow me off and do not discipline nor change policy? Do I withdraw my child's enrollment and just blindly hope that other customers know of their utter disregard for the trust we've placed in them? Do I report them to the police or child protective services? Do I picket the business and attempt to inform other people of the issues? What if informing the public simultaneously informs some criminals of the ability to do some baby snatching? In this scenario, a parent actually has some legal recourse options to ensure the problem is fixed. The issue in web security is there is no governing authority to report the problem to and if we take our findings public, we place other customer's information at risk and put ourselves in a position of legal risk as well. We get branded a "criminal hacker" and find ourselves off to jail.