Hacker News Reader

Comment by kerng | Hacker News Reader

Companies internally find and fix security bugs all the time and dont talk about it if no known breach occured. Is there a requirement to do this? Maybe there should be a requirement to document that due diligence occurred to understand if it was exploited?

View on HN

How do you even differentiate this from routine server maintenance that installs kernel patches etc. Theoretically those are all vulnerabilities that exposed data and every single company which is learning of them through CVE etc., should be reporting potential breaches if you hold companies to that bar.

I would think it should be required to report. Just because you don’t know if a vulnerability was exploited does not mean it was not.

I assume cloud providers have hundreds of security issues that are found internally over the course of a year. Requiring reporting would certainly be a step forward and testing in production for software would maybe be seen as what it is, an engineering anomaly and failure to perform due diligence.

That’s fair. I suppose I would aim for a distinction between minor and major flaws. What would be a reasonable threshold?

You are going to be off by at least an of magnitude. You'd see multiple reports per day for a diligent company.

I don't see the benefit. We'd all just end up with a barrage of emails we don't really care about.

The notification don't need to be email. If there's no evidence of a breach, I think it would be reasonable for them to disclose into some kind of vulnerability database. Maybe someone could later determine if the vulnerability was exploited based on some data dump found on the dark web or something.

They only kept 2 weeks worth of logs. So the correct statement is: in 2 of 156 weeks since the bug was accessible no known breach occurred.

Reply on news.ycombinator.com