5 ms·

I for one welcome our new convention of giving security vulnerabilities cute logos and names. It elevates their importance in the public eye, which -- I hope -

by jlebar 12y ago

I for one welcome our new convention of giving security vulnerabilities cute logos and names. It elevates their importance in the public eye, which -- I hope -- will elevate the importance of finding, fixing, and avoiding security vulnerabilities among the technoscenti. I'll go out on a limb and say that if this pattern continues, it may be the most significant legacy of heartbleed.

yzzxy 12y ago
The problem with this strategy is it runs the risk of reassigning resources from the most dangerous vulnerabilities (which infosec-trained sysadmins and developers know how to judge) to those with the best marketers and designers behind their team. It's the same as Oracle DB deals being sold to executives over rounds of golf instead of to the developers who will actually work with the service. To be clear, I'm not sales-phobic or anti-design, I just don't think that security vulnerabilities need to be marketed. The only argument I can see would be consumer awareness, but that might be worse than anything else - just look at the mass hyperbole being thrown around right now about the alleged direct North Korean involvement in the Sony hacks, a contention which few people in the security world appear to take seriously. I guess find a way to get hotfixes out reliably?
- hawkice 12y ago
  > To be clear, I'm not sales-phobic or anti-design, I just don't think that security vulnerabilities need to be marketed. I understand this worry, but I don't think executives will ever see sites like this... except when engineers say HOLY HANNAH WE NEED HOURS TO FIX THIS RIGHT NOW, and the executive says "I have a fixed budget, and this doesn't make me money." Then this site is brought up. And the world is better.
  - yzzxy 12y ago
    Hmm. So maybe, within the bowels of listservs and whitepaper archives, we hide a secret repository of slick, sexy marketing pdfs that engineers can print, cover in a shiny plastic folder, and strategically deploy as a measure of last resort. Or just work to make developer<->management communications more effective.
    - hawkice 12y ago
      I think you've captured the absurdity of the scenario quite well. Unfortunately, I don't have quite the poker face to pull off a claim like "developer <-> management communications aren't absurd". To be slightly more fair: it's pretty easy to think "if solving this problem was really important, it would already have a budget, like how hurricanes get disaster relief". And so spending $100 on a logo helps people not dismiss the urgency. This whole situation is not amazing. But an emergency isn't the time to start working on developer <-> management communication problems -- at that point, whatever gets the job done is great.
thrownaway2424 12y ago
I, for one, do not welcome the trend of information-free wankerism masquerading as security research. I would like proof-of-concept code, formatted in 80-column plain text, dropped on mailing lists. Not this unreadable javascript-laden junk that doesn't even tell me anything worth knowing.
- cloakandswagger 12y ago
  Seriously. I call these "designer vulnerabilities" They have little substance beyond a flashy name, logo and website giving the most generic of bullet points about their exploit. Do a Google search and you'll find dozens of news articles harping about the designer vulnerability alongside the name of the company that discovered it. What could be a legitimate exploit dealt with through the channels we've always addressed them through becomes a marketing vehicle for info sec charlatans.
- hamburglar 12y ago
  Note how they drop the CVE number at the beginning of the article, even though it's not actually a published CVE yet. Is there any legitimate reason to do that other than to lend your news release a false air of authority to those who won't bother to go read the CVE?
reedoo 12y ago
If this results in reduced attention for vulnerabilities that don't have a site, logo, and marketing department, then what we've done is imposed a tax on security research. Which is fine, because security work is extremely overfunded and we don't have globally critical infrastructure like OpenSSL developed by one or two dudes begging for donations.
spb 12y ago
If anybody missed it, the logo actually copies the little dribbly bits from the Heartbleed logo directly.

by jlebar 12y ago

yzzxy 12y ago

The problem with this strategy is it runs the risk of reassigning resources from the most dangerous vulnerabilities (which infosec-trained sysadmins and developers know how to judge) to those with the best marketers and designers behind their team. It's the same as Oracle DB deals being sold to executives over rounds of golf instead of to the developers who will actually work with the service. To be clear, I'm not sales-phobic or anti-design, I just don't think that security vulnerabilities need to be marketed. The only argument I can see would be consumer awareness, but that might be worse than anything else - just look at the mass hyperbole being thrown around right now about the alleged direct North Korean involvement in the Sony hacks, a contention which few people in the security world appear to take seriously. I guess find a way to get hotfixes out reliably?

hawkice 12y ago
> To be clear, I'm not sales-phobic or anti-design, I just don't think that security vulnerabilities need to be marketed. I understand this worry, but I don't think executives will ever see sites like this... except when engineers say HOLY HANNAH WE NEED HOURS TO FIX THIS RIGHT NOW, and the executive says "I have a fixed budget, and this doesn't make me money." Then this site is brought up. And the world is better.
- yzzxy 12y ago
  Hmm. So maybe, within the bowels of listservs and whitepaper archives, we hide a secret repository of slick, sexy marketing pdfs that engineers can print, cover in a shiny plastic folder, and strategically deploy as a measure of last resort. Or just work to make developer<->management communications more effective.
  - hawkice 12y ago
    I think you've captured the absurdity of the scenario quite well. Unfortunately, I don't have quite the poker face to pull off a claim like "developer <-> management communications aren't absurd". To be slightly more fair: it's pretty easy to think "if solving this problem was really important, it would already have a budget, like how hurricanes get disaster relief". And so spending $100 on a logo helps people not dismiss the urgency. This whole situation is not amazing. But an emergency isn't the time to start working on developer <-> management communication problems -- at that point, whatever gets the job done is great.

thrownaway2424 12y ago

I, for one, do not welcome the trend of information-free wankerism masquerading as security research. I would like proof-of-concept code, formatted in 80-column plain text, dropped on mailing lists. Not this unreadable javascript-laden junk that doesn't even tell me anything worth knowing.

cloakandswagger 12y ago
Seriously. I call these "designer vulnerabilities" They have little substance beyond a flashy name, logo and website giving the most generic of bullet points about their exploit. Do a Google search and you'll find dozens of news articles harping about the designer vulnerability alongside the name of the company that discovered it. What could be a legitimate exploit dealt with through the channels we've always addressed them through becomes a marketing vehicle for info sec charlatans.
hamburglar 12y ago
Note how they drop the CVE number at the beginning of the article, even though it's not actually a published CVE yet. Is there any legitimate reason to do that other than to lend your news release a false air of authority to those who won't bother to go read the CVE?

reedoo 12y ago

If this results in reduced attention for vulnerabilities that don't have a site, logo, and marketing department, then what we've done is imposed a tax on security research. Which is fine, because security work is extremely overfunded and we don't have globally critical infrastructure like OpenSSL developed by one or two dudes begging for donations.

spb 12y ago

If anybody missed it, the logo actually copies the little dribbly bits from the Heartbleed logo directly.