Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability reports are not special anymore

words.filippo.io

Post reply on HN
Print view View original

101–110 of 249 posts

Re: Vulnerability reports are not special anymore

#101

Post by dns_snek »

lemagedurage wrote: post #58
inigyou wrote: post #53

Earlier quoted context omitted.

Why would anyone pay money to have a chance of being arrested?

If a vulnerability disclosure program has a good track record of paying out, and legitimate reports get refunded, why not? Again, the alternative might be shutting down the program entirely.

Those are 2 big "ifs". The incentives are completely misaligned and the platforms work for the companies. They would now have an even bigger incentive to stonewall and close valid issues than they did before.

They already like blurring the lines by rejecting reports that have clear reproduction scripts, videos, demonstrable (but not critical) impact. They'll close it as "not a bug" but then also forbid disclosure and stonewall mediation requests. Reports are supposed to be kept private until the issue is fixed but the system gets abused to cover up issues long after they've been fixed.

In some cases I strongly suspect it's to evade liability for financial damages that their customers might've suffered. Platform mediation always takes their side and if you want to do what's right, you will get banned.

Re: Vulnerability reports are not special anymore

#102

Post by WD-42 »

Gigachad wrote: post #6
themanmaran wrote: post #2

I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam. Occasionally I see real security researchers on HN complaining that no one takes the disclosure seriously, or that people reply immedia…

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

Time to start banning those that submit fake or superficial reports. Maybe with enough bans these people will start actually reading their own vulnerabilities.

Re: Vulnerability reports are not special anymore

#103

Post by edelbitter »

nikanj wrote: post #91
Gigachad wrote: post #6

Earlier quoted context omitted.

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

CVE 10 if you use you current version of Python to serve files over ftp, and parse the incoming files using the most obscure file type found in the forbidden libraries of the Vatican And your ISO etc certificates make this CVE mandatory priority 1 action point

I think this one has more to do with excessive dependencies, and lack of splitting into individually installable packages and/or static linking.

I have already avoided having to evaluate whether I am affected by some issue because I added patches at startup that crash before certain unused-yet-installed modules are to be loaded. Also, for those Python packages that still have a pure version that defers to stdlib and a separate muh-performance binary option with statically linked dependencies, I can generally just install the former and skip the version bumps for dependencies. The performance advantage may be negligible or negative outside of benchmarking 100k calls.. of code actually called 11 times a day, on a non-critical path.

Re: Vulnerability reports are not special anymore

#104

Post by froddd »

Gigachad wrote: post #90
jamesfinlayson wrote: post #87

Earlier quoted context omitted.

Yeah I completely understand their intent, but I might get 30 vulnerabilities across a multiple repos flagged in a week. It is already tedious to check them all and assess if they're worth worrying about let alone having to update them. These are 99% Javascript though - I suspect other ecosystems are much more manageable.

It's easier to keep stuff up to date these days. If you have a project with typescript, unit tests, and end to end tests like cypress you can just have dependabot create the PRs to update packages. If everything passes you just have to hit the merge button. Just updating everything is probably easier than assessing if it's possible to trigger an exploit with the way you use the package.

This is exactly how developers of malware want you to behave. Update without really thinking about it.

I do wonder how long it will take before an attack is developed by submitting a semi-genuine vulnerability, shortly followed by a ‘fix’ including malicious code.

Re: Vulnerability reports are not special anymore

#107

Post by ozim »

cleverfoo wrote: post #64
lemagedurage wrote: post #58

Earlier quoted context omitted.

If a vulnerability disclosure program has a good track record of paying out, and legitimate reports get refunded, why not? Again, the alternative might be shutting down the program entirely.

It's not a horrible idea... the challenge there would be making that payment/refund flow totally transparent in order to build trust and be fair to the researchers.

Making, payment/refund setup is more complicated than „set and forget”.

First question: Do you keep money for shit reports?

Well no, you have to pay it back like credit card validation. There is no pain for posting shit report just inconvenience. There is no legal way where you can keep the money.

Re: Vulnerability reports are not special anymore

#108

Post by WD-42 »

jamesfinlayson wrote: post #51
themanmaran wrote: post #30

Earlier quoted context omitted.

Seriously. We got 116 github dependabot alerts this week. Half of them for dev dependencies.

I tried to raise that with my internal security team recently - don't clutter my vulnerability dashboard with issues in dev dependencies. They somewhat rightly pointed out that malware needs to be dealt even if it's a dev dependency. So my suggestion went nowhere because I guess we can't filter by type of vulnerability.

A lot of the recent npm attacks have been exfiltration from dev machines, which would just as likely from dev dependencies.

Re: Vulnerability reports are not special anymore

#109

Post by Maxion »

Gigachad wrote: post #90
jamesfinlayson wrote: post #87

Earlier quoted context omitted.

Yeah I completely understand their intent, but I might get 30 vulnerabilities across a multiple repos flagged in a week. It is already tedious to check them all and assess if they're worth worrying about let alone having to update them. These are 99% Javascript though - I suspect other ecosystems are much more manageable.

It's easier to keep stuff up to date these days. If you have a project with typescript, unit tests, and end to end tests like cypress you can just have dependabot create the PRs to update packages. If everything passes you just have to hit the merge button. Just updating everything is probably easier than assessing if it's possible to trigger an exploit with the way you use the package.

Yep this is what has happened to small teams. You really only have time to approve the dependabot changes and go go go. Otherwise you'll never get anything productive done.

The other option is to simply ignore updates and do them on a schedule, e.g. once every 1-2 months.

Post reply on HN