Hacker News Reader

Comment by rubiquity | Hacker News Reader

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this?

> Marketing Helps Accomplish Legitimate Goals

Are you kidding me? The only goal of a security issue should be fixing it and getting everyone else to update to the fix. Heartbleed will be remembered forever because of the BS marketing.

OpenSSL isn't a startup, it's a security library that is used by over half of the internet.

View on HN

Yes, a thousand times yes. The point isn't to market a vulnerability, the point is to get a fix out there.

Forcing the entire world to scramble is great marketing, but poor security. Vendors needed time to prep releases and communications; there's tons of confusion flying around out there.

Likewise, patio11's trying to capitalize on the awareness to market himself may also be great marketing, but it's bad advice.

I don't know why parent is being downvoted, either. This is simply not how you keep people secure. This is how you grandstand to promote yourself at the cost of other people's security.

"Likewise, patio11's trying to capitalize on the awareness to market himself"

That's what I took away from this as well.

How is patio11 using this "to capitalize" and "to market himself"? Anyone who follows him knows that security-related "PSAs" are a staple of his Twitter feed. Combine that with the fact that he writes about marketing on a regular basis and this post is very much par for the course. Both his PSAs and his material on marketing and business are a real service to everyone. That's why they've been so popular on HN for years.

> Both his PSAs and his material on marketing and business are a real service to everyone. That's why they've been so popular on HN for years.

HN loves startup porn, but how is this any different than how self-help books are marketed?

Distrust anyone who makes a business out of telling other businesses how to be successful in business because of how they're successful in business.

The people who are successful don't have time to run consultancies, and anyone that knows anything about consultancies knows that the lessons you learn there are very different than what's useful and necessary for product companies.

I agree with you in a general sense, but I disagree with you in this particular case.

patio11 first made a business, then did consulting, and is now building another business.

Bingo Card Creator. Let's just keep the scale in mind here.

Bingo Card Creator and Appointment Reminder. The latter is big enough he's started doing angel investing. Keep in mind, he runs both of them by himself and he no longer consults. I'm not saying he doesn't have an ulterior motive, but his motives are considerably more pure than 99% of the articles on hacker news.

Not that it matters. Who cares where the advice comes from if it works? And if it doesn't work, the purest motives in the world isn't going to make it work.

The path to fixing it is in part through marketing. A lot of companies need to be aware about how dangerous this vulnerability is. Look how hard is it to get them to upgrade to latest TLS or most modern/secure ciphersuits, and so on. If marketing can help convince them to do it a lot sooner, than god speed.

The problem is that just "getting a fix out there" isn't enough. People have to deploy that fix for it to mean anything. And the way you get people to deploy a fix is to make them aware that they need to.

Given how widely deployed OpenSSL is, and how many of those systems are run by part-time or amateur sysadmins who aren't going to be monitoring CVE lists constantly, getting the word out that (1) there's a huge problem and (2) here's how you fix it is of paramount importance.

I believe that in this case marketing is a great way to get a fix out there. It's a commitment act, Schelling-style [0]. They basically forced everybody in the world to drop everything and fix this issue right fucking now. The seriousness of Heartbleed warrants that level of marketing, IMO.

[0] - http://en.wikipedia.org/wiki/Thomas_Schelling#The_Strategy_o...

Part of getting the fix out there is marketing. If the fix is out there and no one knows about it, or the powers that be don't care, what good is the fix?

Wait, surely getting everyone to scramble is a good way to get the fix released soon?

Marketing is entirely the wrong way to get the people who release fixes to scramble. At least at the top few tiers (package developers and distribution maintainers) you know the organizations necessary to contact, and how to contact them. If the orgs are worth their salt, a descriptive email to their security contacts is faster and easier than a marketing campaign.

Marketing is useful to get sysadmins too lazy to subscribe to security announcement mailing lists to apply the already-released patches or take other mitigation.

> Marketing is useful to get sysadmins too lazy to subscribe to security announcement mailing lists to apply the already-released patches

Which, let's be honest, is the vast majority of people who admin servers these days.

With cloud servers, VPSes, etc., anyone can become a "sysadmin," and lots of people do who don't really understand what they are signing up for. These are the people running the unpatched boxes that Ars Technica recently called "the slum houses of the Internet." (http://arstechnica.com/security/2014/03/ancient-linux-server...)

Those people aren't going to patch their system just because a CVE was issued. They don't know what a CVE is. So marketing the problem is critical to reach them and get them off their duffs.

No, it's a good way to get half-broken fixes rushed out the door while users are left blowing in the wind due to premature grandstanding public release.

Who is "the public" here? Why should package maintainers be hearing about this any sooner than me? I may not help maintain a popular Linux distribution, but I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection. (Hypothetical.) After disclosure, my only option is not to wait for a fix from my vendors and service providers, but to shut down my service (and lock out my customers) until a fix is available from them (or my own efforts) hours later. Otherwise, the bad actors who would benefit from seeing their SSL traffic would have hours to do so, and for some of us that can cost lives.

This marketing page was effective communication not just to the public, but the hundreds of thousands of technical people that needed to understand that this disclosure was different, they needed to take action, which in this world of plentiful managed hosting, is really not typical.

I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection

If that is the case, your FMEA needs to include undisclosed vulnerabilities in your communication channel's encryption, and the mitigation can't be telling the internet your particular opinions on responsible disclosure.

Whew. Good thing I don't run such a service. :-) (Edited my comment to better emphasize that it was hypothetical.)

I knew it was hypothetical, I was just building off my experience with this as a reality and not a thought experiment. I think that your hypothetical is useless to this conversation. The seriousness of death is a good argument tool, but using it in the context of responsible disclosure is theatrics.

Arguing for people with privileged access to the exploit to behave the way you want when disclosing it, is a lot like arguing that people with privileged access to the exploit behave the way you want when exploiting it (ie: don't exploit). When human safety relies on an encrypted channel, you have no option but to assume people aren't going to act the way you want. If you could get people to act the way you want, you wouldn't need to use an encrypted channel in the first place.

Yup. It's a great point. I do frequently mention the safety aspect in conversations about secure channels because I know that was how the importance of the work was pitched to me when I worked with a VPN provider in the past. (As a developer, but not in a role where I would have anything to do with the FMEA you mentioned. I had to look that acronym up.) I think it's a good point for people to keep in mind.

> Why should package maintainers be hearing about this any sooner than me?

Because they vend updates to the vast majority of users. It's about maximizing people's ability to get the fix quickly upon public disclosure.

> ... they needed to take action, which in this world of plentiful managed hosting, is really not typical.

What action do you think you need to take? Revoking certificates? Almost nothing checks OCSP or CRLs anyway, there's hardly a rush.

All this marketing has done is sent ill-informed people scurrying.

> What action do you think you need to take?

Waiting until Debian gets its shit in order is not sufficient for a number of friends of mine who work at places that take security very seriously. They disabled access as soon as it became public knowledge.

No, a thousand times no. It's pretty obvious big targets would be on top of this. But given the severity of this bug you need to get to the lazy sysadmin, to the small ecommerce owner that doesn't have an on site admin, etc.

Small e-commerce sites and lazy sysadmins are probably running such old, outdated versions of OpenSSL that they aren't vulnerable to this bug anyway.

Of all the problems we have, server-side adoption in the face of serious security flaws is not one of them.

The marketing is just confusing people, and patio11's advocacy for more irresponsible marketing-focused disclosure is self-promotional, ambulance chasing, and irresponsible in the extreme.

Small ecommerce owner gets OpenSSL from their hosting vendor. Lazy sysadmin is running 'apt-get update' && 'apt-get install', and if he's not, there are 50 other serious vulnerabilities he's open to anyway.

Reply on news.ycombinator.com