4 ms·

Hmm have you done this with private disclosure? If not, please do that next time. It is unethical to disclose security-related issue of some PaaS publicly witho

by yeukhon 13y ago

Hmm have you done this with private disclosure? If not, please do that next time. It is unethical to disclose security-related issue of some PaaS publicly without first going through the responsible party first. Even if a security issue you want to report is actually something only the owner can see... I don't know what this do because I don't really use DO, but just judging the way it is reported, it looks like you haven't...

nknighthb 13y ago
Even if one bought the ridiculous notion that private disclosure of vulnerabilities is a good thing, why would you think it would be necessary to privately "disclose" to anyone what Digital Ocean already publicly documents in their API?
- yeukhon 13y ago
  [edit]: okay I misunderstood the issue here. Some day I would forget to close my home door with a bang. No home invasion yet because nobody notice that the door wasn't fully closed. Now I am telling people I will forget to close my door, and I will get an invasion. Some people's repo have password committed. It only takes someone to google that to find out. If someone posts that on HN, yeah, it's on the web anyway, it only takes one person to make my password known instantly.
  - nknighthb 13y ago
    You are extremely confused. Digital Ocean does this deliberately and already publicly documents it. It is intentional. This is not a bug report to Digital Ocean or any other PaaS. It is a request for a third-party library to support an option Digital Ocean's API provides.
    - yeukhon 13y ago
      [edit]: okay I misunderstood the issue here.
  - jlgaddis 13y ago
    This is the equivalent of complaining very loudly and publicly that someone broke into your house after the police warned you, "Hey, you shouldn't leave your door standing open -- someone might break in."
    - deleted 13y ago
      [deleted]
sneak 13y ago
http://www.wired.com/wiredenterprise/2013/04/digitalocean/ http://www.wired.com/wiredenterprise/2013/04/digitalocean/ https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... This sort of terrible behavior was by design and known. They got written about and claimed to have fixed it, but didn't.
icelancer 13y ago
>It is unethical to disclose security-related issue of some PaaS publicly without first going through the responsible party first. Says who? You? DO has a history of not responding to issues UNTIL they are publicly disclosed. And in any case, your iron-clad "argument" is a matter of opinion and nothing else. Many people prefer full disclosure.
- yeukhon 13y ago
  > Says who? You? > And in any case, your iron-clad "argument" is a matter of opinion and nothing else. First, let me repeat: I did get the story mix up and the ethical approach I am referring to doesn't quite apply in the current story. > DO has a history of not responding to issues UNTIL they are publicly disclosed. Does not matter what happen between DO and whitehats. If an OS command injection is discovered, even if DO has a history of not responding to security issues, the moment the vulnerability is discovered, a whitehat should alert DO privately first. If they ignore it again, then of course you can let the public know and let your zero-day exploit begin. Regarding this, public disclosure before private disclosure is unethical.
  - icelancer 13y ago
    >Regarding this, public disclosure before private disclosure is unethical. I guess you consider Bruce Schneier a peddler of unethical behavior, then? He maintains the threat (and execution) of full disclosure is vital to maintaining security.
    - sigzero 13y ago
      Bruce does NOT advocate an end run around the provider. You talk to the provider first, always.
      - yeukhon 13y ago
        Exactly. Full disclosure does this. Before full disclosure was the norm, researchers would discover vulnerabilities in software and send details to the software companies -- who would ignore them, trusting in the security of secrecy. Some would go so far as to threaten the researchers with legal action if they disclosed the vulnerabilities. https://www.schneier.com/essay-146.html https://www.schneier.com/essay-146.html If the code is public, just fixing the code without CVE or similar is considered bad because diffing the code will yield the vulnerability. You don't go around and tell people you found a vulnerability until it is fixed (in the case of vendor ignoring alert it is ethical to tell the public).
mikeash 13y ago
There is someone in this thread claiming to speak for DO, and he says that it's fully documented: https://news.ycombinator.com/item?id=6983520 https://news.ycombinator.com/item?id=6983520 There's no point in private disclosure for something that the company themselves documents. Of course, he also whines about responsible disclosure. The mutual exclusivity of these two things does not seem to have occurred to him....

by yeukhon 13y ago

nknighthb 13y ago

Even if one bought the ridiculous notion that private disclosure of vulnerabilities is a good thing, why would you think it would be necessary to privately "disclose" to anyone what Digital Ocean already publicly documents in their API?

yeukhon 13y ago
[edit]: okay I misunderstood the issue here. Some day I would forget to close my home door with a bang. No home invasion yet because nobody notice that the door wasn't fully closed. Now I am telling people I will forget to close my door, and I will get an invasion. Some people's repo have password committed. It only takes someone to google that to find out. If someone posts that on HN, yeah, it's on the web anyway, it only takes one person to make my password known instantly.
- nknighthb 13y ago
  You are extremely confused. Digital Ocean does this deliberately and already publicly documents it. It is intentional. This is not a bug report to Digital Ocean or any other PaaS. It is a request for a third-party library to support an option Digital Ocean's API provides.
  - yeukhon 13y ago
    [edit]: okay I misunderstood the issue here.
- jlgaddis 13y ago
  This is the equivalent of complaining very loudly and publicly that someone broke into your house after the police warned you, "Hey, you shouldn't leave your door standing open -- someone might break in."
  - deleted 13y ago
    [deleted]

sneak 13y ago

http://www.wired.com/wiredenterprise/2013/04/digitalocean/ http://www.wired.com/wiredenterprise/2013/04/digitalocean/ https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... This sort of terrible behavior was by design and known. They got written about and claimed to have fixed it, but didn't.

icelancer 13y ago

>It is unethical to disclose security-related issue of some PaaS publicly without first going through the responsible party first. Says who? You? DO has a history of not responding to issues UNTIL they are publicly disclosed. And in any case, your iron-clad "argument" is a matter of opinion and nothing else. Many people prefer full disclosure.

yeukhon 13y ago
> Says who? You? > And in any case, your iron-clad "argument" is a matter of opinion and nothing else. First, let me repeat: I did get the story mix up and the ethical approach I am referring to doesn't quite apply in the current story. > DO has a history of not responding to issues UNTIL they are publicly disclosed. Does not matter what happen between DO and whitehats. If an OS command injection is discovered, even if DO has a history of not responding to security issues, the moment the vulnerability is discovered, a whitehat should alert DO privately first. If they ignore it again, then of course you can let the public know and let your zero-day exploit begin. Regarding this, public disclosure before private disclosure is unethical.
- icelancer 13y ago
  >Regarding this, public disclosure before private disclosure is unethical. I guess you consider Bruce Schneier a peddler of unethical behavior, then? He maintains the threat (and execution) of full disclosure is vital to maintaining security.
  - sigzero 13y ago
    Bruce does NOT advocate an end run around the provider. You talk to the provider first, always.
    - yeukhon 13y ago
      Exactly. Full disclosure does this. Before full disclosure was the norm, researchers would discover vulnerabilities in software and send details to the software companies -- who would ignore them, trusting in the security of secrecy. Some would go so far as to threaten the researchers with legal action if they disclosed the vulnerabilities. https://www.schneier.com/essay-146.html https://www.schneier.com/essay-146.html If the code is public, just fixing the code without CVE or similar is considered bad because diffing the code will yield the vulnerability. You don't go around and tell people you found a vulnerability until it is fixed (in the case of vendor ignoring alert it is ethical to tell the public).

mikeash 13y ago

There is someone in this thread claiming to speak for DO, and he says that it's fully documented: https://news.ycombinator.com/item?id=6983520 https://news.ycombinator.com/item?id=6983520 There's no point in private disclosure for something that the company themselves documents. Of course, he also whines about responsible disclosure. The mutual exclusivity of these two things does not seem to have occurred to him....