Disclosure timeline for vulnerabilities under active attack | Hacker News Reader

Disclosure timeline for vulnerabilities under active attack

googleonlinesecurity.blogspot.com

138 pointsrubinelli30 comments

It would be best (per the HN guidelines) to title this submission with the original article title, "Disclosure timeline for vulnerabilities under active attack." That's a more neutral spin than the headline "Google: 7 days advance notice is enough for actively exploited vulnerability" originally submitted here.

I posted this yesterday with the original article title, but linked to the .com version of the post, not the .com.br version: https://news.ycombinator.com/item?id=5789736

They really should merge duplicate submissions under the first submission in these cases.

I wouldn't call the current title a "spin"; it's just a short summary of what Google explicitly said in the post that's more informative than the post title.

(Compare this key quote: "Based on our experience, however, we believe that more urgent action -- within 7 days -- is appropriate for critical vulnerabilities under active exploitation.")

The original article title is very weak, though – corporate dullspeak that obscures the real news, the new 7-day standard replacing an earlier 60-day standard.

It is possible to improve many headlines, and despite the slightest twinge of editorializing added by the "...is enough..." wording, the submitted headline was both accurate and informative.

It's more neutral because it takes out a bunch of useful information and leaves practically nothing left, like a news story that's unbiased because it doesn't bother actually saying any facts. The original title doesn't even explain that Google is changing their policy. I understand wanting to remove editorializing, but there's a difference between that and adding some detail from the article itself to a rather contentless title.

More aggressive reporting and patching I support.

On a side note, I have a hard time taking any blog at a .blogspot.com domain seriously. Don't know why.

Agreed. I don't think there is anything stopping me from registering googleinternetsecurity.blogspot.com or officialonlinesecurity.blogspot.com if they filter out "google."

Nor googleinternetsecurity.com. A TLD doesn't make it more legit, but at least under Blogspot, Google can shut down an imposter once discovered.

How about internetsecurity.google.com? They control their own TLD, they can make subdomains.

internetsecurity.google.com could set cookies on google.com

I think you mean they control a second-level domain. The top level domain is "com" in the example of "internetsecurity.google.com".

http://en.wikipedia.org/wiki/Top-level_domain

Yes, that was what I meant :).

The Google security folks have been getting more and more selective about what goes under google.com (especially user-generated content) because stealing google.com cookies gives you the user's auth tokens.

Using different domains reduces attack surface area [1]. That said, I agree that the blogspot domain and site design look amateurish.

[1] https://github.com/blog/1466-yummy-cookies-across-domains

It's a policy issue:

> If we receive a removal request that violates local law, that content may no longer be available to readers on local domains where those laws apply.

https://support.google.com/blogger/answer/2402711?hl=en

Not only that, its a .blogspot.com.br domain.

When I removed the .br part it redirected me to .blogspot.co.uk

Likely, the .br is there because the original submitter (here on HN) is from Brazil. Blogspot tends to redirect to the subdomain of the reader's country for some reason.

.br isn't a subdomain, it's a TLD.

If you want to get technical. A TLD is the subdomain of the root.

It really is .br. but the last . is left of for convenience.

I would even say that full disclosure should be standard in such cases. If vulnerability is already exploited, some bad guys already know about it. Keeping it secret, even for a short time, gives these bad guys advantage and hurts users that can not take any extra precautions until the vulnerability is disclosed.

Not sure that follows, since 'bad guys' aren't monolithic.

It may still be less damaging for only 'some' bad guys to be using the vulnerability, and continue to think that only they know it. (Thus, they use it sparingly). Immediate full disclosure means 'all' bad guys learn of the vulnerability, and then perhaps rush to maximally exploit (knowing they're in a race to use ASAP or lose their chance).

7 days is a fine maximum, but not necessarily a target. A malicious 3rd party script should be removed in an hour.

Are there any independent groups that rate a firm's response to an exploit? Other than HN comments and (rare) legal recourse, I don't know what pressure a YC startup faces to do a good job in a holistic sense. It'd be nice if a respected 3rd party were around to shame sites if necessary.

I wonder if this has anything to do with the 3rd party software used to compromise drupal.org?

How would they know that a zero-day that they discover is being actively exploited?

They have examples of malware that use that exploit?

...perhaps gathered from honeypots or spear-phishing observed in gmail.

Usually because either them or a high profile customer was hacked with it.

what vendor are they referring to? was this related to Tavis Ormandy's trolling of microsoft.

Security?

Reply on news.ycombinator.com