12 ms·
Full-disclosure – Administrivia: The End
- NathanOsullivan 13y agoIt seems ironic for the end to arrive without full disclosure of why.
- mhurron 13y agoYes it would seem in the vein of the list to out the 'researcher' who is being the final asshole.
- sspiff 13y agoWhat would be the point, other than nailing that person to a post and having them exposed to various forms of Internet abuse? As you said yourself, this is just the final straw.
- NathanOsullivan 13y agoIt seems ironic for the end to arrive without full disclosure of why.
- aidos 13y agoCan someone from the security community explain exactly what the list is? Is it a mailing list where researchers disclose exploits that have been found (after doing their best to responsibly notify the developers of the effected systems)?
- thirsteh 13y agoYes (vulnerabilities rather than exploits, although these disclosures often contained proofs of concept.) It was the de facto standard vehicle for this.
- tptacek 13y agoNo, it was the de facto standard mailing list for releasing vulnerabilities. Over the last 7 years it's gotten less and less relevant as a way of releasing vulnerabilities, because large public mailing lists are not a particularly effective way to publish vulnerabilities. People seem to believe that happened because vulnerabilities started to obtain a market value, but: * The serious high-end memory corruption vulnerabilities were (a) more common and (b) much simpler at FD's inception, making them more amenable to posting on a list; in 2014, a high-end vulnerability is likely to be complex enough to merit in-depth consideration on a blog instead. * Table-stakes XSS vulnerabilities also tend to get written up in blogs (where they help establish a track record for researchers whose future employers aren't going to trawl through FD looking for them), and when they get bought, get bought by bug bounties. It is hard to argue that bug bounties are a bad thing; nobody benefits from a web vulnerability in a SaaS product other than the operator of the SaaS product.
- michaelw 13y agohttp://en.wikipedia.org/wiki/Full_disclosure_(mailing_list) http://en.wikipedia.org/wiki/Full_disclosure_(mailing_list) Full disclosure is a lightly moderated security mailing list generally used for discussion about information security and disclosure of vulnerabilities. The list was created on 9 July 2002 by Len Rose and is administered by John Cartwright. The wikipage goes on to list some notable zero-day vulnerabilities.
- deleted 13y ago
- DangerousPie 13y agoHe didn't really explain the full problem so maybe I am not fully appreciating the situation here, but this seems like a pretty big overreaction for a stupid request from some a single user.
- nknighthb 13y agoAre you unfamiliar with the phrase he used, "straw that broke the camel's back"?
- gilgoomesh 13y agoIn this context, it's really a weasel term. He's functionally given no explanation.
- asuffield 13y agoSeems pretty clear - burnout. After 12 years of abuse he's had enough.
- fnordfnordfnord 13y agoIt's a message to his listserv users, not a press release. More context can be found in the archives, or from someone who follows the list closely.
- woof 13y agoIf you care about context, read the list....
- buro9 13y agoI would give little explanation too nowadays. In the past I've given lots of information about requests to moderate or otherwise remove content from forums I run. Then I was hit with a cease and desist, and again provided transparency of it. The very predictable Streisand effect kicked in, and then I was hit with a harassment case too (for disclosing the details even though I knew it would likely trigger Streisand). It was all resolved quite peacefully, but one fire-fights these things reasonably over the years and get to learn that the other party is usually not being reasonable. You can either result in escalation, or you can calm things down. It's a lot easier to pick the option that calms things down if it's available to you. And in case above, that was apocalyptic, to close the list without disclosing detail behind it. The last straw really breaks the camels' back. Once broken, it's not getting up to fight on. Life is too short.
- lazyjones 13y agoHe doesn't disclose much information, but it looks a bit like he (sourly) blames the industry and community for something that is very common elsewhere too: to run a public forum or mailing list, you now need not only the users' support and goodwill, but also legal counsel, a thick skin and willingness to challenge legal threats, as well as all sorts of technical means to fend of malicious activities (DoS/spam protection etc.). What's stopping such communities from going "underground", i.e. to some darknet where anonymity and protection from some of these hassles still exists?
- cjfont 13y agoNothing -- such underground communities do exist, but then it is no longer a public forum.
- dfc 13y ago> What's stopping such communities from going "underground", i.e. to some darknet where anonymity and protection from some of these hassles still exists? Principle? The whole point of FD was for these discussions to happen in the open.
- nixgeek 13y agoToday is a sad day. I wonder what will replace full-disclosure as the de-facto vehicle to announce vulnerabilities.
- guard-of-terra 13y agoPastebin + reddit?
- Bjoern 13y agoWow, this is sad. Hope we can get more info on what was going on. Besides Bugtraq what mailing lists security wise do you follow? EDIT: Or what other general means by Twitter, Websites, Databases, Blogs etc. do you recommend?
- spindritf 13y agoSecunia has a free Secunia Weekly Advisory Summary newsletter. You need to register for an account at https://secunia.com/community/profile/ https://secunia.com/community/profile/ and tick a box for a weekly summary IIRC. But it's probably easier and more convenient to subscribe for announce mailiing lists for software you're using. Unless you can turn off affected services or scramble and patch before maintainers.
- tptacek 13y agoWhy would you follow any mailing lists for security in 2014? The concept of a security mailing list predates Twitter, vulnerability databases, Reddit, and blogs. But we have all those things now, and they are all better than Full-Disclosure on its best days.
- Bjoern 13y agoYeah people keep telling me mail is dead, but its still kicking around and is very well alive. Let me edit my initial question to be email neutral though.
- icebraining 13y agoWhy are they better?
- uaygsfdbzf 13y agoAbstractly, I think the benefit email has over the above are nearly-immediate decentralization. All the other above mediums (generally) are either (A) centralized services or (b) require some sort of polling mechanism to poll a distribution point. I think it is harder to redact from an email list than any of these. Also, twitter's conversation layout in the web portal annoys the F* out of me. Sig Hash: f4bbafebca1ef074672ec2da3debd812
- galapago 13y ago"He who foresees calamities, suffers them twice over"
- BuildTheRobots 13y ago> "He who foresees calamities, suffers them twice over" --Beilby Porteus, Bishop of Chester and London, 1731-1809. Not heard the quote before; thank you.
- cousin_it 13y agoOr avoids them.
- jruthers 13y agoWould anyone mind explaining to me as a noob what kind of legal challenges public lists need to defend against these days? Spam, trolls and politics are not new, but legal threats and DoS attacks I didn't expect to be problems.
- Bjoern 13y agoSome companies like to practice 'security by obscurity' to the fullest. They sometimes try to keep bugs from being disclosed by researchers using various means of ignore up to legal threats or other non disclosure contracts. Often when things are at a really bad state its in the public interest to make sure these issues get fixed rather than brushed under the carpet. Hence it gets posted on various sec ML lists to ramp up pressure.
- ef47d35620c1 13y agoSites that allow anonymous postings through tor (e.g. reddit) are the last remaining voice of freedom on the Internet. It is unfortunate that HN is not numbered among those sites. Edit: I was incorrect about HN. See the comment below. I am happy to learn that I was wrong.
- ig1 13y agoDon't trust Tor to provide anonymity against government adversaries. It's likely not secure given Snowden disclosure of anti-Tor tools.
- ef4 13y agoI actually think Snowden's documents support a cautious optimism about Tor. The techniques they detail all amount to an admission that Tor itself is still quite difficult for the NSA to de-anonymize at scale. They resort to exploits against browsers instead, which is far less scalable and far more risky. According to Snowden, the NSA doesn't want to waste valuable vulnerabilities on low-value targets (since this risks discovery and disclosure, making the vulnerability useless in the future). So they can't do mass surveillance of Tor, and can only de-anonymize targeted individuals under optimal conditions.
- haakon 13y agoAlso, Snowden has a Tor sticker on his laptop.
- deleted 13y ago[deleted]
- throughtor 13y ago>It is unfortunate that HN is not numbered among those sites. Why do you think that? I'm posting from tor with a fresh throwaway account.
- icebraining 13y agothroughtor: yes, and your post is dead on arrival.
- brianmwaters_hn 13y agoWhat a shame; I just recently started taking on an interest in computer security and signed up for the list. In just the few weeks I was on there, I learned about a vulnerability in a device I had recently bought. I am cherishing the opportunity (which I haven't found time for yet) to walk through my first exploit! As a newcomer I'm not really sure what John's referring to, though. Too bad...
- JPKab 13y agoI'll offer my take on his "industry that shouldn't have become an industry". One of the biggest drivers of cash into information security hires is government regulation. Otherwise, a lot of these companies could give a shit if they lose private data. Enter the information security specialist who has no fucking clue how to program or do anything remotely technical. They went out and got their CISSP cert, and now they provide a legal shield to the corporation or government office that hires them. Their very presence provides the security theater needed to protect their employer from being sued for not providing the necessary security. If you are a CISSP on here, the fact that you're on this site means you are in the minority of your loser poser peers. You probably hate these posers as much as I do.
- brianmwaters_hn 13y agoWow, that's a harsh view on the CISSP and infosec pros in general. Though I'm not necessarily disagreeing with you.
- toyg 13y agoI think John's point was more wide-ranging. Even without regulation, the truth is that security has long become just another market, where vulnerabilities and skills are bought and sold for cash, like any other commodity. Security used to be an aspect of system administration; now it's just another rat race with all the trappings of commercialisation ("enterprise" products etc etc).
- drblast 13y agoHey now, that's really unfair. Nobody I know who has a CISSP cert got it willingly. Other than that though, carry on.
- chris_wot 13y agoWhat exactly happened?
- woof 13y agoSomebody set up us the bomb! Seriously, use 30 seconds to browse, ie http://marc.info/?l=full-disclosure&r=1&b=201403&w=2 http://marc.info/?l=full-disclosure&r=1&b=201403&w=2 Notice 144 posts about "Google vulnerabilities with PoC"?
- unreal37 13y agoThat's an ugly thread with people putting each other down in every post.
- lawnchair_larry 13y agoHaha, that is on the more civil side of FD discussions. Many hackers have ego problems.
- gwu78 13y ago"... an industry that never should have become an industry."
- binaryatrocity 13y agoFirst thing I saw in my inbox when I got to work this morning. Sad really, the list has certainly had it's moments. Can't help but be a little optimistic, at least the "Google Vulnerability with PoC" youtube-upload trollfest chain of emails is done flooding my inbox this month :D
- kang 13y agoWhat are some other similar lists to follow?
- znowi 13y agoInstrumental in this message for me was this part: There is no honour amongst hackers any more. 10-20 years back a term hacker had a close relation to a certain moral conduct emphasizing freedom of knowledge. Today with a mass market of startups, that was largely popularized by Hacker News, this perception has changed. A hacker now is a founder. He must be good at raising money, monetizing a product and the greatest feat of all - exit. There's no more moral obligations of the past. Launch at all cost - the rest is an afterthought. There's a discrepancy between the two cultures. I think this divide is the source of the mailing-list problem and problems with freedom of information and privacy at large we have today.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- FiloSottile 13y agoHere you are speaking about the two different meanings of hacker, security-hacker and startup-hacker. Yes, there is a big difference, and you described it. But it's not the point. Full-disclosure is all of security-hackers. And the sad thing is that there is no more honour amongst security-hackers. In the 90s they used to share 0-days. Today, well if you don't sell it you're a fool. I'm so sad I missed that period, IRC, the lulz. Don't confuse the hacker spirit with the hacker word.
- supersystem 13y agoThe "startup-hacker" doesn't really exist. It's just a label for people who can't necessarily identify with being a businessperson.
- at-fates-hands 13y ago>>> 10-20 years back a term hacker had a close relation to a certain morale conduct emphasizing freedom of knowledge. Agreed. There was a certain "code" people adhered to. Even groups like LOD wouldn't release exploits because they feared people would use them for nefarious purposes.
- majke 13y agoA bit of context, maybe it will be helpful for some: http://seclists.org/fulldisclosure/2014/Mar/170 http://seclists.org/fulldisclosure/2014/Mar/170 http://seclists.org/fulldisclosure/2014/Mar/294 http://seclists.org/fulldisclosure/2014/Mar/294 http://seclists.org/fulldisclosure/2014/Mar/291 http://seclists.org/fulldisclosure/2014/Mar/291 http://seclists.org/fulldisclosure/2014/Mar/286 http://seclists.org/fulldisclosure/2014/Mar/286 http://seclists.org/fulldisclosure/2014/Mar/298 http://seclists.org/fulldisclosure/2014/Mar/298 And a full email exchange: http://seclists.org/fulldisclosure/2014/Mar/index.html#123 http://seclists.org/fulldisclosure/2014/Mar/index.html#123 My personal favourite (in a positive way): http://seclists.org/fulldisclosure/2014/Mar/160 http://seclists.org/fulldisclosure/2014/Mar/160
- acqq 13y agoSpecifically: http://seclists.org/fulldisclosure/2014/Mar/298 http://seclists.org/fulldisclosure/2014/Mar/298 It seems that one guy not only trolled the list but also he either created new identities for more trolling or managed to attract more trolls as bad as he. The guy also appears to deeply believe he's right. It's still not fully clear to me if he is also the person thus described by the list maintainer: "I always assumed that the turning point would be a sweeping request for large-scale deletion of information that some vendor or other had taken exception to. I never imagined that request might come from a researcher within the 'community' itself (and I use that word loosely in modern times)."
- rdl 13y agoSad :( This was my favorite mailing list for the past decade or so, although it's been in decline for years.
- deleted 13y ago[deleted]
- scmurcott 13y agoReally was a great list, one of my favorite. I will miss it, sincerely.
- teebsd 13y agohttps://news.ycombinator.com/item?id=7431569 https://news.ycombinator.com/item?id=7431569