4 ms·

Anyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month (though of course membership in this club is still off

by amalcon 13y ago

Anyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month (though of course membership in this club is still offered at OpenSSL's sole discretion, and they would be allowed to waive this fee). Google, Amazon, Facebook, and Akamai (off the top of my head) will each pay that without batting an eye; that's $480k/yr. right there. I imagine they could probably get some banks in that club as well.

talklittle 13y ago
This sounds like it would introduce a massive conflict of interest. Also it assumes the OpenSSL team are the first to know about vulnerabilities. Heartbleed has shown that's not always the case.
emilsedgh 13y ago
Don't you think that does not align with the ethics of 'Open'SSL project?
- ceejayoz 13y ago
  Not having enough resources to keep the 'SSL' part working makes the 'Open' part pretty irrelevant.
  - grinich 13y ago
    FOR ENTERTAINMENT PURPOSES ONLY.
cperciva 13y ago
Anyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month If I find a vulnerability in code from a project which is pulling this sort of stunt, I will make sure I share details with distributors only under the strict condition that they are not allowed to tell the project about it. Responsible disclosure usually means "start by telling the authors", because usually the authors know who needs to be contacted and will do that responsibly. If they're just going to sell off exploits to the highest bidders, they should have no role in the disclosure process.
- SoftwareMaven 13y ago
  I'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's about providing details earlier to a group of people who have a strong enough vested interest that they are willing to pay for it and have been vetted as trustworthy enough to allow it. Given how important OpenSSL is to the web's infrastructure (and the many companies who utilize it), I think there would be value in ensuring it has appropriate resources to fulfill that duty. This idea may not be a perfect solution, but calling it a "stunt" is hyperbole, IMO.
  - cperciva 13y ago
    The FreeBSD Security Team works with other software distributors to make sure that they have advisories and patches ready when bugs are first disclosed publicly. In my years as FreeBSD Security Officer, we in very rare cases gave advance notice of vulnerabilities to end users, and those decisions were made on the basis of "we happen to know that these people are using the software in a way which makes them particularly vulnerable". (In most or all such cases we didn't even provide a patch, just a warning of "make sure you have people around at 10AM tomorrow in case you need to release an update quickly".) Nobody ever got advance notice by virtue of having donated money, and I reminded Security Team members that they should not give any advance disclosure to their employers.
  - phil21 13y ago
    >This isn't about delaying details to anybody Yes it is. If you disclose early to a select group, you are by definition delaying details to everyone else. The paid early disclosure stuff used to exist all over the place, and it was a joke in terms of it being immediately leaked to those in the know.
    - SoftwareMaven 13y ago
      Except you can't give security vulnerability details to everybody until you have a patch ready (and I certainly wouldn't argue that you should allow paying for earlier access to the patch). On the other hand, when you have a business relationship with somebody, with non-disclosure agreements in place, you can tell them more details much earlier.
nthj 13y ago
1. Purchase access to the club for $10K/year 2. Wait for next vulnerability 3. Immediately sell details to hackers via bitcoin 4. ??? 5. PROFIT
- smm2000 13y ago
  You offer this membership only to trustworthy members of the community who have interest in keeping their services and products secure such as RedHat, Google, Facebook, Oracle, Debian and so on. I think you can trust people in Google not to exploit vulnerability and not to sell it for bitcoins. Unless critical vulnerability is exploited in the wild, it should first be disclosed to big Linux distributors so they can prepare patches and to companies responsible for critical Internet infrastructure so they can fix their system before telling general public. With this proposal you just charge companies who can afford it membership fees and provide this service for free to open source/non profits who could not afford it.
  - SoftwareMaven 13y ago
    Followed up with an NDA with an indemnity clause.
amalcon 13y ago
So, people are definitely misinterpreting my suggestion. This is my fault, as looking back I stated it pretty badly. The goal is to give businesses who are already in the early-warning club an excuse to write $10k checks every month. The intention was not to solicit anyone and everyone. It would continue to only be offered to organizations who are (in the collective opinions of the OpenSSL project leaders) going to neither leak nor use the vulnerability -- exactly what happens today. They would be allowed to (and, I'd hope, would) waive the fee if a major stakeholder were obstinate about it, because (I hope) they actually care about the security of the Internet.
- judk 13y ago
  Your proposal is still bad :-) but the good faith attitude with which you engaged responders is a model for mature discourse.
deleted 13y ago
[deleted]

by amalcon 13y ago

talklittle 13y ago

This sounds like it would introduce a massive conflict of interest. Also it assumes the OpenSSL team are the first to know about vulnerabilities. Heartbleed has shown that's not always the case.

emilsedgh 13y ago

Don't you think that does not align with the ethics of 'Open'SSL project?

ceejayoz 13y ago
Not having enough resources to keep the 'SSL' part working makes the 'Open' part pretty irrelevant.
- grinich 13y ago
  FOR ENTERTAINMENT PURPOSES ONLY.

cperciva 13y ago

Anyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month If I find a vulnerability in code from a project which is pulling this sort of stunt, I will make sure I share details with distributors only under the strict condition that they are not allowed to tell the project about it. Responsible disclosure usually means "start by telling the authors", because usually the authors know who needs to be contacted and will do that responsibly. If they're just going to sell off exploits to the highest bidders, they should have no role in the disclosure process.

SoftwareMaven 13y ago
I'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's about providing details earlier to a group of people who have a strong enough vested interest that they are willing to pay for it and have been vetted as trustworthy enough to allow it. Given how important OpenSSL is to the web's infrastructure (and the many companies who utilize it), I think there would be value in ensuring it has appropriate resources to fulfill that duty. This idea may not be a perfect solution, but calling it a "stunt" is hyperbole, IMO.
- cperciva 13y ago
  The FreeBSD Security Team works with other software distributors to make sure that they have advisories and patches ready when bugs are first disclosed publicly. In my years as FreeBSD Security Officer, we in very rare cases gave advance notice of vulnerabilities to end users, and those decisions were made on the basis of "we happen to know that these people are using the software in a way which makes them particularly vulnerable". (In most or all such cases we didn't even provide a patch, just a warning of "make sure you have people around at 10AM tomorrow in case you need to release an update quickly".) Nobody ever got advance notice by virtue of having donated money, and I reminded Security Team members that they should not give any advance disclosure to their employers.
- phil21 13y ago
  >This isn't about delaying details to anybody Yes it is. If you disclose early to a select group, you are by definition delaying details to everyone else. The paid early disclosure stuff used to exist all over the place, and it was a joke in terms of it being immediately leaked to those in the know.
  - SoftwareMaven 13y ago
    Except you can't give security vulnerability details to everybody until you have a patch ready (and I certainly wouldn't argue that you should allow paying for earlier access to the patch). On the other hand, when you have a business relationship with somebody, with non-disclosure agreements in place, you can tell them more details much earlier.

nthj 13y ago

1. Purchase access to the club for $10K/year 2. Wait for next vulnerability 3. Immediately sell details to hackers via bitcoin 4. ??? 5. PROFIT

smm2000 13y ago
You offer this membership only to trustworthy members of the community who have interest in keeping their services and products secure such as RedHat, Google, Facebook, Oracle, Debian and so on. I think you can trust people in Google not to exploit vulnerability and not to sell it for bitcoins. Unless critical vulnerability is exploited in the wild, it should first be disclosed to big Linux distributors so they can prepare patches and to companies responsible for critical Internet infrastructure so they can fix their system before telling general public. With this proposal you just charge companies who can afford it membership fees and provide this service for free to open source/non profits who could not afford it.
- SoftwareMaven 13y ago
  Followed up with an NDA with an indemnity clause.

amalcon 13y ago

So, people are definitely misinterpreting my suggestion. This is my fault, as looking back I stated it pretty badly. The goal is to give businesses who are already in the early-warning club an excuse to write $10k checks every month. The intention was not to solicit anyone and everyone. It would continue to only be offered to organizations who are (in the collective opinions of the OpenSSL project leaders) going to neither leak nor use the vulnerability -- exactly what happens today. They would be allowed to (and, I'd hope, would) waive the fee if a major stakeholder were obstinate about it, because (I hope) they actually care about the security of the Internet.

judk 13y ago
Your proposal is still bad :-) but the good faith attitude with which you engaged responders is a model for mature discourse.

deleted 13y ago

[deleted]