Hacker News Reader

I feel for your acute pain in the past, but:

>> but he seems to not give a shit about the impact of releasing a zero day, that perhaps only he knows about, on businesses trying to earn a crust. Not very responsible

You are ignoring the impact of constantly extending deadlines for companies that don't take security seriously within 90 days of notification. At some point, there must be consequences as a negative feedback signal to show that you mean business and won't just constantly push these back until you fix your negligence.

The Project Zero guidelines must have teeth. And they do. And it causes acute pain, and they know it. It is to spur companies on to do the right thing.

Without open disclosure first without time-barred restrictions, we never would have settled on "responsible disclosure" with embargoes and such. Companies and organizations need to know they will be held accountable.

I'd be up for "gradual disclosure" after 90 days. Something that gives some kinda hint as to the storm ahead but doesn't hand out a pre-built bunch of stuff the script-kiddies can fuck your business over with.

We were pretty fucking good at security on our platform (Windows and Linux), but if you've no idea something like this is coming down the pipe, it's hard to mitigate once TO and pals decide to release working exploits.

I think you must be talking about CVE-2010-0232, it wasn't 90 days, it was more like 180. This was at a time when Microsoft refused to release kernel patches outside of service packs. I begged Microsoft at multiple in-person meetings at Redmond to reconsider and patch, they simply refused and said there were would be repercussions if I disobeyed.

After four months of negotiations, I told that I'm going to publish it whether a patch was available or not. This didn't have the effect I had hoped, they started threatening me instead. They called me and told me my career would be destroyed. In one particularly memorable call they told me that their PR and legal department only had two settings, "off and destroy" and (in a rather menacing tone) that they would "air my dirty laundry in public". I still don't know what that means.

I was shaken, but told them I'm still going ahead. They responded by calling everyone they knew at my employer demanding I was terminated.

There was a trivial mitigation, just disabling a very rarely used feature (vdm support for 16 bit applications). I made detailed documentation explaining how to enable the mitigation for every supported platform, and even made tutorial videos for Administrators on how to apply and deploy group policy settings.

Here are the instructions I wrote:

https://seclists.org/fulldisclosure/2010/Jan/341

And here's a video I made showing how to apply the policy to a Windows Server 2003 machine like yours:

http://www.youtube.com/watch?v=XRVI4iQ2Nug

I sent these detailed instructions to all the usual places that advisories are published. I included a test case so you could verify if the bug affected you and verify the mitigation was correctly deployed. As you can imagine, Microsoft were furious.

I know it's little comfort, but through some hard fought battles over the last decade we have reached the point that Microsoft can reluctantly patch critical kernel security bugs if given around three months notice. They still pull some dirty tricks to this day, you wouldn't believe some of the stories I could tell you, but those are war stories for sharing over beers :)

It sounds like your attackers compromised you with an outdated wordpress installation, then gained privileges with this vulnerability. I'm not sure I agree the blame here lies solely with me, but regardless, I would recommend subscribing to the announce lists for the software you're deploying. You could also monitor the major security lists for advisories related to the software you use. It's high volume and varies in quality, but you can usually identify the advisories that apply to you easily.

That’s mental and very damning. Most defences of MS in this thread lean on goodwill, which is completely lost here. After this behaviour, I’m surprised you even gave them one more day. Acting like they’re in a goddamn Scorsese movie.. shame on those kids. They weren’t raised right.

They should have lost the 90 day privilege to begin with.

1) You should have named names. A jerky company is merely one composed of jerky people and it is those people who should be shamed.

2) Developers need to be unafraid to stick up for their principles and to prioritize their career more than their job, because idiot managers exist. The job might fire you; your love of technology will not. Glad you seemed to stick to your guns; you will be vindicated.

> there were would be repercussions if I disobeyed.

That's absolutely incredible. Not that I don't believe you, more that I find it incredibly stupid of them to think that you could be intimidated like that.

This is a nice little bit of backstory for those that wish to peddle the tale that the Microsoft of today is nothing like the one from before.

Microsoft is one of many companies that did things like that in the past (and some still try). This abusive behavior in the past is why many groups have strict release policies after some amount of time, and even why some people will drop anonymous zero days. You cannot trust these companies to do the right thing. Time and time again they have gone as far to attempt to make security research illegal.

That's 9 years ago though. A lot has happened in the past few years.

Yeah, like project zero forcing Microsoft’s hand to be more responsible, for example. Tavis doing this now is what paved the way for the next Tavis who comes along, who will now be able tonget issues fixed without threat of their lives being ruined by a megacorp.

It must have been “fun” having all those follow-up skip-level 1:1s after those calls! I don’t envy your position, but good work!

>> Something that gives some kinda hint as to the storm ahead but doesn't hand out a pre-built bunch of stuff the script-kiddies can fuck your business over with.

That's what the author already gave on day zero. Why does there need to be more extensions, gradients, and timelines for a trillion dollar market cap company's core product?

> Something that gives some kinda hint as to the storm ahead but doesn't hand out a pre-built bunch of stuff the script-kiddies can fuck your business over with.

I am not an expert, but an argument I've heard before is that this is worse, because a "hint" that describes the impact in even broad terms has a good chance of giving attackers enough a clue to figure out what the issue is. Meanwhile it will not contain a patch or detailed mitigation steps (because that would be too specific) so even fully informed administrators will be left helpless until whenever "full disclosure" happens.

It sounds like your beef should be with Microsoft for failing to patch a severe bug after 3 months.

> Sure MS should have moved faster to plug the hole, but you know, Windows is a helluva legacy code base,

Microsoft is not some 10 person startup. They have ample resources to fix these problems if they choose to prioritize them appropriately. The decision not to is on them. I guarantee that if the deadline was 180 days, they'd still miss the deadline on some of these issues and complain about not having enough time.

No, they are more like a 200-car freight train than a sportscar that can turn on a dime. I suspect just getting the problem into the backlog could chew up weeks.

Then they need to fix their process to be more agile in response to urgent problems.

Not every hacker is going to be nice and give 90 days notice. Sometimes the first notice you'll get is when a vulnerability is already being exploited in the wild. And if you takes you weeks just to begin to respond to that, then that's your problem.

I bet satya can get any thing he likes to the very tip-top of the priority list with a single call or email.

I feel sympathy for your situation, but if you want to read an alternative opinion that is just as harsh as your opinion of Tavis then consider this (which I don't necessarily endorse):

No one owes your company the ability to make a profit, and if you can't make money without removing the free speech rights of security researchers (who are improving the state of the industry) then perhaps you need to change your business model (or your OS).

Sorry for all the pain you went through. Without discounting it, I do think that it's not about reveling in disruption. The uniform signal sent to software companies (there is no software company too big for us to bend our rules) leads to better global outcomes.