Hacker News Reader

Comment by wutwutwat | Hacker News Reader

What is the point of the dedicated vulnerability marketing websites? Like, for real, why do people buy a domain, configure dns, design a full webpage, setup some server somewhere?

Is there some secret world I don't know about that's driven by how banger your vulnerability disclosure presentation is? Every one anymore has a full site. Is this what it takes to get attention these days? Everything, including computer bugs, needs a marketing campaign? Every time I see these sites I roll my fucking eyes at how ridiculous it is that people keep making them, but it seems to only be increasing in occurances.

Can someone explain this to me because I feel like I'm missing something. Just feels like peak consumerism and attention economy bs that shouldn't be needed imo, but I hope I'm missing some crucial thing that makes these valid

View on HN

It's because when a news website wants to talk about the vulnerability they get a webpage to link to that is canonical and has all the information someone would want to get an accurate description of the issue.

Isn't that exactly what https://www.cve.org/ would be for?

Yes

No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.

CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.

Yeah, that's not how Apple's CVEs work.

On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue?

I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc.

I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?

> schmorgus board

I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).

Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]

Bahahaha no, the vast majority of CVE’s are at best a vague description, a severity score, and no context.

Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.

I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job

That’s certainly your prerogative!

The amount of time and effort they spent setting up the website – since this is 2023 and websites are super easy to set up – is probably dwarfed by the amount of time they spent on the vulnerability itself.

The time and effort isn't the concern, the precedent that a vulnerability isn't severe unless it has a marketing campaign these are setting is, and based on some comments here, it's taking place

They waited over a year before disclosing the vulnerability. Since Apple didn't fix it in that time, they're now relying on negative publicity to pressure Apple into fixing the issue.

And the problem here is that Apple and other companies don't address these vulnerabilities until someone forces their hand. That's why a "marketing campaign" is required, unfortunately.

This site regularly upvotes posts on X (nee Twitter) and Medium and other sites that actively nag me. It would take me less than 6 minutes to register a domain on njalla, pay in crypto, add the DNS to cloudflare, and upload some static files to a GitHub repo. And no nagware! Even if it is self promotion, I couldn't be bothered to whine about this when I'm inundated with far more bullshit from far more prominent, frequent actors on a daily basis.

I don't get bothered by people doing it because they are able to, or care how long it takes them to spin it up, good for them. The thing that bothers me is that disclosing sec vulnerabilities isn't a popularity contest, and as you can see from other comments here, people are gauging the severity of the vulnerability based on if it has a fucking marketing website or not. That's not a good pattern to keep enforcing imo

If people are actually judging the importance of a vuln based on "it has a domain" then my issue would be with them.

People have all sorts of miscalibrated heuristics with which they judge things. Regardless of the originators intentions.

Treat the problem not the symptoms. People can't use the marketing site to gauge severity if they don't exist.

Why is your question not directed at the people that bother you, if that is the case?

Seems rather unproductive to question why the site exists when your problem is with people using the existence of the site to make decisions.

My problem is with the sites existing, which is what my original comment is asking about. The people using them to guage severity is a symptom of the problem of these sites being a thing, and is naturally going to happen in a world like this. If the website marketing doesn't exist, the people using them to gauge severity won't be able to do so. Treat the problem not the symptoms.

If I had a website that posted a sci-fi story and people misinterpret the story as being real and factual, should I take my website down or should people refresh themselves on how to differentiate sci-fi from reality?

I would argue that the people who think the existence of a website is a good gauge for vulnerability severity need to have a refresher on how to gauge vulnerability severity. The inability/lack of education in how to assess severity is the root of the problem in my opinion.

I have no idea how to go about responding to your hypothetical question, people reading fiction and thinking it's real doesn't compare to people being conditioned to not care about sec vulns unless it has a dedicated website with pretty logos.

War of the Worlds was broadcast and people freaked out that aliens were invading. I don't think they tracked each of those people down and told them to not be so stupid, they started adding disclaimers to the broadcasts so people coming in late or whenever they would know it was a story and fiction. They fixed the problem not the symptoms.

Agree to disagree, I guess.

Everything seems to be a popularity contest now. I’ve seen people with the job title “Cyber Influencer”.

It could just be that the researcher is immensely proud of their work and wants to show it off with its own website, logo, clever name, etc.

They should be proud, and I'm not bothered by that one bit, the work they did is a great thing. This website existing or not should have no bearing over the good work they did or them being proud of the work they did.

> domain on njalla, pay in crypto, add the DNS to cloudflare

one of these things is not like the other

This is hosted on GitHub Pages, so it takes very minimal resources to setup and keep running. The domain is also likely $10, assuming they didn't need to pay a squatter for it.

I think it's just a trend for any any huge-scale vulnerability research team to put together a website for it, as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large.

And it doesn't always happen. Log4shell, for example, was not its own website: https://news.ycombinator.com/item?id=29504755

> as that amount of effort will indicate a certain level of attention the exploit requests of the reader / the security community at large.

Feels like a dangerous way to gauge the severity of issues. What if the discloser doesn't have the funds or the skills to setup a dedicated website? Will it not get any attention since there's no yodawgiheardyoulike0days.com website to float up to the top of HN? This is what CVE severity scoring is for and what should be used, not the presence of a dedicated website, no?

CVE scoring is about as worthless as whether a vulnerability has a website.

Maybe, but it's at least an agreed upon system and a centralized database and format, which can be improved since a org is behind it with the goal to make sec vul disclosure the best it can be. The wild west of marketing websites isn't advancing towards any sort of shared understanding.

I am 100% on board with free and easy assignment of CVEs and a central database of them. I just don't think they are a good place for keeping vulnerability details, because it is too rigid. Having a link to relevant details is good enough, and if the link happens to just include everything in it then I'm fine with that.

> What if the discloser doesn't have the funds or the skills to setup a dedicated website?

Evidently they just get ignored, if their account of direct disclosure to Apple is anything to go off of.

"All crisis is profit." :)

Clearly we need Vulnerability Website as-a-Service (VWaaS).

(joking or not? even i don't know! What I know is, there seems to be a fine line between cynicism and prophecy...)

You joke but I bet it's already in the YC fall 23 batch

It's a paper. Plenty of papers come with their own website. The purpose of a paper is to make its findings publicly accessible, so putting in the extra work for a website to accompany it is understandable.

maybe they want to maximize their career opportunities? It's gotten better over the years, but for a long time security researchers and white-hats toiled away and never even got a "thanks", sometimes they got legal threats. If I had the patience to work in this industry I'd want to maximize my returns.

> Like, for real, why do people buy a domain, configure dns, design a full webpage, setup some server somewhere?

Same can be said for personal blogs. The purpose is showing off. By the way, setting up a server nowadays is ridiculously easy and cheap. If you have done it a few times and you use a simple static site stack with CI then you can have a site live in 15-30 minuted including SSL and hosting for free (GitHub Pages, Cloudflare, or GitLab Pages for example).

Personal blogs, or any other website, have nothing to do with creating branding and dedicated websites to disclose security vulnerabilities. Computer bugs have logos.

Have developers really come full circle to "why do we make websites?"

Yes, that's what my comment was asking, why do we make websites, you nailed it, and I thank you for the concise way of asking what I took so many more words to ask above.

Yes, we dream of an alternate timeline with CVE promos on TCP/IP HyperCard https://www.wired.com/2002/08/hypercard-what-could-have-been...

In think its plausible that hosting it yourself ensures that companies can't exert pressure to have it removed.

it's a webpage promoting a vulnerability they found and a paper they wrote and is owned by georgia institute of tech. they ~~have servers~~ are just using github pages and a budget already i'm sure for marketing. this is marketing.

Nope you’ve got it in one

Reply on news.ycombinator.com