Comment by busterarm | Hacker News Reader

Comment by busterarm | Hacker News Reader

Responsible disclosure is a scam that puts vulnerability researchers, downstream project maintainers and users in the position of being malicious actors all while absolving those responsible from their responsibility.

Immediate and public disclosure is the only responsible disclosure there is and I commend (and monetarily contribute to) the OpenBSD Project for their soft stance against embargoes.

Operating in opposition to that, a large portion of the security industry plays along for reasons varying from personal pride (appealing to authority makes you feel like one of the good guys) to the extremely lucrative payouts for selling 0day to nation states. It's no surprise that the higher your profile in the industry and on twitter, the easier time you have getting paid out on bug bounties. All of this hurts users.

I develop and maintain software and software infrastructure for a living. If you find a vulnerability in work I am responsible for, please rake me over the coals as publicly and loudly as you can. That motivates the PTB who fund my work to resolve the issue better than anything else.

I'm not convinced.

Google's policy seems about right to me. When they discover a security flaw in someone else's software, they give them 90 days before making it public [0]. The choice of 90 days is to strike a balance between applying strong pressure to the company to get it fixed fast, and giving them a reasonable amount of time to get it done and rolled-out. My understanding is that this approach generally works fairly well.

You'd rather that they adjust that notice period all the way down to zero, and hand vulnerabilities over to the bad guys for free right out of the gate?

[0] https://arstechnica.com/information-technology/2015/02/googl...

You are assuming that the white hat security researcher was the first to discover the flaw. That is a perfectly reasonable assumption, and your position is perfectly reasonable given that assumption.

GP was assuming that the white hat security researcher was not the first to discover the flaw, and that the flaw is actively being used to attack users. That is a perfectly reasonable assumption, and GP's position is perfectly reasonable given that assumption.

That's still not enough. Even if bad guys are already using the exploit in the wild, it still isn't responsible to immediately make it public. If the exploit isn't already public, that means the bad guys are treating it as something to be traded in secret. (And of course, the only reason we're discussing this is that the exploit is not already public.)

Instantly publishing the details of the exploit may well broaden its use by bad actors, by reducing its market price to zero.

There are dedicated teams of people who are highly skilled, well-funded and working full time at finding exploits with the intent of selling or using them.

The bad guys already have the vulnerabilities long before the good guys do.

Lower-skilled criminals and script kiddies who are relying on disclosure before they can do anything are far less ambitious and do far less damage.

Stuxnet and recent high-profile banking malware all employed legitimate 0day and did real damage to people. Vulnerability disclosure contributed nothing towards that.

But I'm not saying this to convince you, I'm saying this to keep my stuff secure. Google doesn't choose 90 days out of a sense of anything other than what's good for Google and its shareholders.

Any vulnerability a white-hat finds is already for sale to criminals and governments on Russian dark-web forums anyway.

See my reply - https://news.ycombinator.com/item?id=18309062

Reply on news.ycombinator.com