3 ms·

> the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed the bug Classic MSRC. It has fi

> the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed the bug Classic MSRC. It has figured out that researchers will report for free regardless. Why change?

natpalmer1776 4mo ago
It was the status quo for a long time, then the pesky security researchers started asking for compensation instead of clout.
- ammar2 4mo ago
  > instead of clout I'm catching up on the infosec twitter side but it seems like it was even worse. A lot of people have the same story as me in 2023 of "they silently patch the bug and don't even credit you" which really stinks.
  - natpalmer1776 4mo ago
    It definitely reminds me of the stereotypes of big business types stepping on the little guys to climb the ladder. I hope you get credit where credit is due in future endeavors.
  - DANmode 4mo ago
    That’s most of the why it’s tough to be upset when people just release 0-days on Twitter - especially for big firms.
- opello 4mo ago
  Do it for the exposure! Artists of many stripes have had to combat that for ages.
guessmyname 4mo ago
MSRC doesn’t fix bugs. I don’t know the specifics of this case, but I’ve managed bug bounty programs in the past through Bountysource and HackerOne. One thing that occasionally happens is that a report makes its way to the development team before the security team has fully assessed it, in this case MSRC. At that point, a developer may decide to quietly fix the issue. Sometimes that’s driven by a concern, rational or not, that being associated with a security bug could reflect poorly on them or affect future promotion opportunities. The result is that by the time the security team attempts to reproduce the report, the vulnerability is already gone. From MSRC’s perspective, all they see is that the provided reproduction steps no longer work. They have no visibility into the internal history of the bug or whether someone already patched it. As a result, the report gets closed as invalid even though the original finding may have been legitimate.
- anonbanana 4mo ago
  That makes sense but doesn't excuse the behavior. Just because there is poor communication within Microsoft doesn't make it okay to silently patch a vulnerability. Also, looking at the timeline on OP's post from 2023 it seems they patched it and closed the bug on the same day which is a little sus .
- moi2388 4mo ago
  Nonsense. As if there are no versions for their software releases. This is laziness, security absolutely could verify these steps.
  - IcyWindows 4mo ago
    Sure, given infinite time, they could diligently try to reproduce every bug across every version of any given product or open source library from a team at Microsoft. However, if you have 1000s of reports a day, many of them vague with the person hoping it's close enough to a real issue to get paid, it makes sense to me personally that one needs prioritize active issues over tracking down when other issues were fixed.
- peterkelly 4mo ago
  If only there were some kind of system for recording the version history and viewing what changes had been made to the code between releases.
- theguidessuck 4mo ago
  > They have no visibility into the internal history of the bug or whether someone already patched it. Aww man, if only they owned some sort of platform for tracking those, powered by some sort of program. Doesn't even have to be a smart problem, it can be, succintly, shortly, stupid. If only.
- hilariously 4mo ago
  Your post reads like "This doesn't happen, except when it happens and the person has no recourse and it does in fact happen." - why make the post at all? If your internal workings fuck over someone externally prepare for your department to take the blame even if its "not your fault" - you work at the company that just fucked them over.

natpalmer1776 4mo ago

It was the status quo for a long time, then the pesky security researchers started asking for compensation instead of clout.

ammar2 4mo ago
> instead of clout I'm catching up on the infosec twitter side but it seems like it was even worse. A lot of people have the same story as me in 2023 of "they silently patch the bug and don't even credit you" which really stinks.
- natpalmer1776 4mo ago
  It definitely reminds me of the stereotypes of big business types stepping on the little guys to climb the ladder. I hope you get credit where credit is due in future endeavors.
- DANmode 4mo ago
  That’s most of the why it’s tough to be upset when people just release 0-days on Twitter - especially for big firms.
opello 4mo ago
Do it for the exposure! Artists of many stripes have had to combat that for ages.

guessmyname 4mo ago

MSRC doesn’t fix bugs. I don’t know the specifics of this case, but I’ve managed bug bounty programs in the past through Bountysource and HackerOne. One thing that occasionally happens is that a report makes its way to the development team before the security team has fully assessed it, in this case MSRC. At that point, a developer may decide to quietly fix the issue. Sometimes that’s driven by a concern, rational or not, that being associated with a security bug could reflect poorly on them or affect future promotion opportunities. The result is that by the time the security team attempts to reproduce the report, the vulnerability is already gone. From MSRC’s perspective, all they see is that the provided reproduction steps no longer work. They have no visibility into the internal history of the bug or whether someone already patched it. As a result, the report gets closed as invalid even though the original finding may have been legitimate.

anonbanana 4mo ago
That makes sense but doesn't excuse the behavior. Just because there is poor communication within Microsoft doesn't make it okay to silently patch a vulnerability. Also, looking at the timeline on OP's post from 2023 it seems they patched it and closed the bug on the same day which is a little sus .
moi2388 4mo ago
Nonsense. As if there are no versions for their software releases. This is laziness, security absolutely could verify these steps.
- IcyWindows 4mo ago
  Sure, given infinite time, they could diligently try to reproduce every bug across every version of any given product or open source library from a team at Microsoft. However, if you have 1000s of reports a day, many of them vague with the person hoping it's close enough to a real issue to get paid, it makes sense to me personally that one needs prioritize active issues over tracking down when other issues were fixed.
peterkelly 4mo ago
If only there were some kind of system for recording the version history and viewing what changes had been made to the code between releases.
theguidessuck 4mo ago
> They have no visibility into the internal history of the bug or whether someone already patched it. Aww man, if only they owned some sort of platform for tracking those, powered by some sort of program. Doesn't even have to be a smart problem, it can be, succintly, shortly, stupid. If only.
hilariously 4mo ago
Your post reads like "This doesn't happen, except when it happens and the person has no recourse and it does in fact happen." - why make the post at all? If your internal workings fuck over someone externally prepare for your department to take the blame even if its "not your fault" - you work at the company that just fucked them over.