4 ms·
I'm disappointed nobody has "leaked" the research so far. If they cared enough to research it in academia, surely they know it's important enough for Tor develo
by higherpurpose 12y ago
I'm disappointed nobody has "leaked" the research so far. If they cared enough to research it in academia, surely they know it's important enough for Tor developers to know about the type of attacks they were performing, despite what any government officials might say? At least some hints should be leaked, if not the whole research.
- dm2 12y agoThat wouldn't really be ethical would it? It would do more harm than good, such as get a lot of people arrested, tortured, killed, and discovered as spies. Responsible disclosure is best, get it patched then release the details of the vulnerability.
- sp332 12y agoThere is a limit. You're also keeping information from the victims who can't protect themselves without your information.
- _nullandnull_ 12y agoYou do realize that "leaked" information on the TOR network could cost an activist their life?
- tptacek 12y agoLeaking hints is the dumbest conceivable way to handle disclosure. It taunts the community and sets up a race to independently find the flaw. The race happens much more openly than the original research, meaning that flaws are incrementally disclosed, ensuring that bad actors of every skill level will get a crack at the attack before it's fully fixed. Don't ever do this, at least not for a bug that matters. It would be better not to disclose at all than to do this.