6 ms·
Disclosure timeline for vulnerabilities under active attack
- joshdance 13y agoMore aggressive reporting and patching I support. On a side note, I have a hard time taking any blog at a .blogspot.com domain seriously. Don't know why.
- benmanns 13y agoAgreed. I don't think there is anything stopping me from registering googleinternetsecurity.blogspot.com or officialonlinesecurity.blogspot.com if they filter out "google."
- CGamesPlay 13y agoNor googleinternetsecurity.com. A TLD doesn't make it more legit, but at least under Blogspot, Google can shut down an imposter once discovered.
- TeMPOraL 13y agoHow about internetsecurity.google.com? They control their own TLD, they can make subdomains.
- deleted 13y ago[deleted]
- mixedbit 13y agointernetsecurity.google.com could set cookies on google.com
- jcrites 13y agoI think you mean they control a second-level domain. The top level domain is "com" in the example of "internetsecurity.google.com". http://en.wikipedia.org/wiki/Top-level_domain http://en.wikipedia.org/wiki/Top-level_domain
- TeMPOraL 13y agoYes, that was what I meant :).
- packetslave 13y agoThe Google security folks have been getting more and more selective about what goes under google.com (especially user-generated content) because stealing google.com cookies gives you the user's auth tokens.
- moonboots 13y agoUsing different domains reduces attack surface area [1]. That said, I agree that the blogspot domain and site design look amateurish. [1] https://github.com/blog/1466-yummy-cookies-across-domains https://github.com/blog/1466-yummy-cookies-across-domains
- tonfa 13y agoIt's a policy issue: > If we receive a removal request that violates local law, that content may no longer be available to readers on local domains where those laws apply. https://support.google.com/blogger/answer/2402711?hl=en https://support.google.com/blogger/answer/2402711?hl=en
- dalore 13y agoNot only that, its a .blogspot.com.br domain. When I removed the .br part it redirected me to .blogspot.co.uk
- Wilya 13y agoLikely, the .br is there because the original submitter (here on HN) is from Brazil. Blogspot tends to redirect to the subdomain of the reader's country for some reason.
- tnorthcutt 13y ago.br isn't a subdomain, it's a TLD.
- dalore 13y agoIf you want to get technical. A TLD is the subdomain of the root. It really is .br. but the last . is left of for convenience.
- bribriinlondon2 13y agoSecurity?
- tokenadult 13y agoIt would be best (per the HN guidelines) to title this submission with the original article title, "Disclosure timeline for vulnerabilities under active attack." That's a more neutral spin than the headline "Google: 7 days advance notice is enough for actively exploited vulnerability" originally submitted here.
- tnorthcutt 13y agoI posted this yesterday with the original article title, but linked to the .com version of the post, not the .com.br version: https://news.ycombinator.com/item?id=5789736 https://news.ycombinator.com/item?id=5789736
- lsaferite 13y agoThey really should merge duplicate submissions under the first submission in these cases.
- comex 13y agoI wouldn't call the current title a "spin"; it's just a short summary of what Google explicitly said in the post that's more informative than the post title. (Compare this key quote: "Based on our experience, however, we believe that more urgent action -- within 7 days -- is appropriate for critical vulnerabilities under active exploitation.")
- gojomo 13y agoThe original article title is very weak, though – corporate dullspeak that obscures the real news, the new 7-day standard replacing an earlier 60-day standard. It is possible to improve many headlines, and despite the slightest twinge of editorializing added by the "...is enough..." wording, the submitted headline was both accurate and informative.
- whateverfor 13y agoIt's more neutral because it takes out a bunch of useful information and leaves practically nothing left, like a news story that's unbiased because it doesn't bother actually saying any facts. The original title doesn't even explain that Google is changing their policy. I understand wanting to remove editorializing, but there's a difference between that and adding some detail from the article itself to a rather contentless title.
- thomasvendetta 13y agoI wonder if this has anything to do with the 3rd party software used to compromise drupal.org?
- bthomas 13y ago7 days is a fine maximum, but not necessarily a target. A malicious 3rd party script should be removed in an hour. Are there any independent groups that rate a firm's response to an exploit? Other than HN comments and (rare) legal recourse, I don't know what pressure a YC startup faces to do a good job in a holistic sense. It'd be nice if a respected 3rd party were around to shame sites if necessary.
- mixedbit 13y agoI would even say that full disclosure should be standard in such cases. If vulnerability is already exploited, some bad guys already know about it. Keeping it secret, even for a short time, gives these bad guys advantage and hurts users that can not take any extra precautions until the vulnerability is disclosed.
- gojomo 13y agoNot sure that follows, since 'bad guys' aren't monolithic. It may still be less damaging for only 'some' bad guys to be using the vulnerability, and continue to think that only they know it. (Thus, they use it sparingly). Immediate full disclosure means 'all' bad guys learn of the vulnerability, and then perhaps rush to maximally exploit (knowing they're in a race to use ASAP or lose their chance).
- guelo 13y agoHow would they know that a zero-day that they discover is being actively exploited?
- interurban 13y agoThey have examples of malware that use that exploit?
- gojomo 13y ago...perhaps gathered from honeypots or spear-phishing observed in gmail.
- lawnchair_larry 13y agoUsually because either them or a high profile customer was hacked with it.
- benmmurphy 13y agowhat vendor are they referring to? was this related to Tavis Ormandy's trolling of microsoft.