Hacker News Reader

Comment by water42 | Hacker News Reader

For all we know Mozilla is complicit in the black market sale of this vuln by the mystery security researcher.

Given Angular 1's popularity, Mozilla has a moral obligation to responsibly disclose this bug to the Angular team and let them determine if its unsolvable or not. Hinting at its existence is one of the worst things they could have done since it will simply give other blackhats motivation to find this vuln while Angular team is not aware of it.

View on HN

We detached this subthread from https://news.ycombinator.com/item?id=12754354 and marked it off-topic.

> For all we know Mozilla is complicit in the black market sale of this vuln by the mystery security researcher.

That's a ridiculous claim

I can't help but think that he's right though. Not explicitly but implicitly. By keeping the vulnerability from the dev team they're allowing it to stay out in the wild. No?

Edit: It may be that this is only an issue inside of Firefox extensions (addons). In which case, maybe the point is moot. See: https://github.com/mozilla/addons-linter/blob/master/docs/th...

There's a world of difference between an exploit being known to someone and that exploit being put up for sale on the black market. In either case, if the researcher who found the exploit sold it, that hardly makes Mozilla complicit in his actions.

I am not sure that I agree. It's hard for me to say where the responsibility for disclosure lies, but if I was Mozilla I'd need to find a good reason not to disclose such a vulnerability to the project owner/development team.

I am not sure that being asked not to disclose is a good enough reason without further justification; in fact it seems like a poor reason to me. Mozilla is in my view kind of a shepherd for internet users and I'd hope they'd fall more on the side of "let's not let our users get owned unnecessarily" than that of "let's sit on this vulnerability just because the disclosing party asked us to."

Well, first of all if they disclosed it they would likely be sued for violating an NDA. Secondly, this would set a bad precedent because now who would ever trust Mozilla with a vulnerability that's behind an NDA?

Isn't it a little soon to be judging them at all? We don't even know if this affects regular use of Angular (on websites) rather than just on rare use cases like browser extensions.

This is a bad comment. You're fear mongering and conjecturing conspiracy theories that don't exist.

That was the way I read it initially to. I think the intended meaning was that we don't know anything about it, up to and including this ridiculous claim. It's more to highlight the lack of transparency than actually put forth a viable theory.

I'd agree if I actually framed it as a legitimate theory. But I didn't.

What do you mean by claiming to not have framed it as a legitimate theory; you're saying it's an illegitimate theory, as in, you yourself don't believe it's true?

See https://news.ycombinator.com/item?id=12754526

It was hyperbole. I personally think that the language is clear too. Here's a good post explaining the usage of the phrase "For all I know" since apparently HN isn't familiar with the idiom https://english.stackexchange.com/questions/92207/what-is-th...

His statement was literally correct, and useful in highlighting a different perspective on what is known to be known. The negativity seems to stem from not taking it literally.

Occam says that the security researcher has notified critically affected parties through the normal channels and Mozilla and others are embargoed from talking about it until its been fixed?

Reply on news.ycombinator.com