Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

101–110 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#101

Post by eschaton »

selectively wrote: post #68
jasonmp85 wrote: post #51

Earlier quoted context omitted.

Does it? Now that I see their name again in this context they're blacklisted for life.

Researchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit. Just fyi. Be glad it was disclosed at all. Be glad a patch was available prior to release.

They should have a legal obligation to engage in coordinated/responsible disclosure, and it should be a crime to sell or disclose a 0day to anyone other than a state-designated security organization or the vendor/provider.

If it won’t be handled through criminal law then it’ll be handled through civil litigation: Anyone who was exploited as a result of this disclosure should sue the discloser for contributing to the damage they’ve suffered.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#102

Post by Quarrelsome »

akerl_ wrote: post #86
Quarrelsome wrote: post #83

Earlier quoted context omitted.

Idk why you felt the need to use quotes to wrap something I didn’t say. Despite the fact I didn't say that, its a much more interesting argument than your original statement implies and it is unfortunate we didn't start there. However the issue is that we cannot know if the attack space has been broadened or lessened as a consequence of this disclosure, because of how eager it was. If it wasn't eager then we could mu…

… I used quotes to wrap something that I was saying. I even called out that it was something I was saying, as a more accurate variant of what you’d claimed I meant.

and I prefaced my quotes with the statement "So I feel like the argument reduces into". I mean, idk what punctuation I'm supposed to use there that doesn't offend you, but I just figured we can all read words and it was clear that I wasn't saying you said that, but rather, as I read the argument it was reducable to that and I took issue with that potential reduction.

The idea about the available exploit space and how the actors within it might, or might not move is a much more interesting avenue of conversation and I thank you for elaborating on your initial comment. I do however feel that its hard to be confident about whether or not the attack space has been increased or reduced as a consequence of the eager disclosure. I feel we could make the case either way.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#103

Post by [deleted] »

xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

[deleted]

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#104

Post by eaf7e281 »

jasonmp85 wrote: post #51
esseph wrote: post #32

Earlier quoted context omitted.

Your advertising for them on HN would help them too, I bet.

Does it? Now that I see their name again in this context they're blacklisted for life.

Same. They do become famous, but not in a wholly positive way.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#105

Post by _yttw »

selectively wrote: post #98
_yttw wrote: post #94

Earlier quoted context omitted.

It seems to me you're unaware of them, but there are strong norms around disclosure. They've been discussed for decades. It is the expectation that vendors would be notified in a scenario like this.

No, there are users who want those to be norms. Qualified researchers happily sell substantive vulns to people who pay (Governments/Cellebrite and companies like that) enough to quell any complaint.

Which is again, irrelevant to the question of how disclosure works and what expectations there are around it because that is not disclosure and is not what was being discussed.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#106

Post by tptacek »

_yttw wrote: post #89
selectively wrote: post #80

Earlier quoted context omitted.

Who cares about how you are seen when you are selling 0day for big bucks? The bad actor makes more money than the 'legitimate' one without breaking any law. Punishing someone who didn't alert distros despite a patch being available encourages the company to simply find flaws and sell them for profit - it pays more to begin with.

If they want to take advantage of disclosure for marketing, they're either going to need to accept the norms around responsible disclosure, or they're going to need to accept how shirking those norms will come off. That's life in society. Sometimes it's annoying and sometimes it doesn't feel rational, but these norms have been negotiated throughout the history of our industry and are the way they are for reasons good…

It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsible disclosure" is an Orwellian term cooked up between @Stake and Microsoft and other large vendors to coerce researchers into synchronizing with vendor release schedules. It was fantastically successful at that, and it's worth pushing back on at every opportunity.

Tavis Ormandy dropped Zenbleed right onto Twitter. He's doing fine. You can blacklist him if you want; I imagine he's not going to notice.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#107

Post by notsound »

Lammy wrote: post #82
xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

> It was extremely irresponsible As a user and admin I disagree. Makes one appreciate what a masterful bit of lexical-engineering “Responsible” Disclosure is, kinda like “Secure” ( from me, not for me) Boot — “Responsible” Disclosure is 100% about reputation-management for the various corporation/foundation middleman entities sitting between me and my computer. Those groups don't care that my individual computer is v…

Those groups care about whether millions of computers are vulnerable, likely including your computer. If "immediate public disclosure" was done in all cases every vuln would be exploited and patches would be much lower quality. Shortening the disclosure timeline might be a good idea, 90 days is starting to feel long.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#108

Post by _yttw »

tptacek wrote: post #106
_yttw wrote: post #89

Earlier quoted context omitted.

If they want to take advantage of disclosure for marketing, they're either going to need to accept the norms around responsible disclosure, or they're going to need to accept how shirking those norms will come off. That's life in society. Sometimes it's annoying and sometimes it doesn't feel rational, but these norms have been negotiated throughout the history of our industry and are the way they are for reasons good…

It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsible disclosure" is an Orwellian term cooked up between @Stake and Microsoft and other large vendors to coerce researchers into synchronizing with vendor release schedules. It was fantastically successful at that, and it's worth pushing back on at every opportu…

You're right, they don't need to. They have an alternative, to accept what people say or think about them in response. That's what I said.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#109

Post by kelnos »

selectively wrote: post #68
jasonmp85 wrote: post #51

Earlier quoted context omitted.

Does it? Now that I see their name again in this context they're blacklisted for life.

Researchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit. Just fyi. Be glad it was disclosed at all. Be glad a patch was available prior to release.

I'm pretty sure they have a legal obligation in most jurisdictions not to sell 0days for profit.

And they absolutely have a moral obligation to do things in a way to minimize damage and impact to other people's systems. (I'm not saying "responsible disclosure" is the correct way to do that, but hoarding vulnerabilities and exploits and selling them to the highest bidder certainly isn't.)

This is how society needs to work.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#110

Post by jodrellblank »

michaelmrose wrote: post #55
akerl_ wrote: post #42

Earlier quoted context omitted.

> maybe even criminal What’s your theory here? What crime?

If it's not a crime I see no reason not to work with partner nations to build responsible disclosure into a legal framework everywhere because it pretty obviously should be.

You know companies are allowed to pay people to find vulns, and pay people bug bounties?

Instead of that, you’d rather make the law compel free individuals to limit their speech, or to hand over their work to big companies privately, so big companies can save money?

That doesn’t sound like a nice future, if it’s even enforceable at all.

Post reply on HN