Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Heartbleed Can Teach The OSS Community About Marketing

kalzumeus.com

Post reply on HN
Print view View original

41–50 of 119 posts

Re: What Heartbleed Can Teach The OSS Community About Marketing

#41

Post by rbanffy »

rubiquity wrote: post #32
rbanffy wrote: post #29

"Your bosses / stakeholders / customers / family / etc also cannot immediately understand, on hearing the words “Rails YAML deserialization vulnerability”, that large portions of the Internet nearly died in fire." I watched my colleagues working around the clock (not that bad as it sounds - we are scattered around the planet for a reason) patching servers, testing and ensuring every hatch is properly shut. I can imag…

You don't think for a second that the reason you were all working so hard to fix this is entirely because of the marketing? The intense marketing of Heartbleed alerted legit crackers (who would have found out anyway), and a thousand times worse, it alerted wannabe crackers of low hanging security exploit fruit. Marketing works both ways, you know.

Communication of the vulnerability was mind-bogglingly bad - knowledge of its existence became widespread well before major distros had patches ready - but the fact remains our servers were vulnerable (and had been vulnerable for a very long time) and needed to be patched ASAP. We must err on the side of caution and consider everyone that should not know of the vulnerability was already fully aware of it and capable of exploiting it.

The same arrogance that makes someone think they are the first to uncover an exploitable security bug makes it sound perfectly natural to build your own memory manager when the one provided by the OS has "bad enough" performance.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#42

Post by higherpurpose »

teacup50 wrote: post #21
rubiquity wrote: post #18

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this? > Marketing Helps Accomplish Legitimate Goals Are you kidding me? The only goal of a security issue should be fixing it an…

Yes, a thousand times yes. The point isn't to market a vulnerability, the point is to get a fix out there. Forcing the entire world to scramble is great marketing, but poor security. Vendors needed time to prep releases and communications; there's tons of confusion flying around out there. Likewise, patio11's trying to capitalize on the awareness to market himself may also be great marketing, but it's bad advice. I d…

The path to fixing it is in part through marketing. A lot of companies need to be aware about how dangerous this vulnerability is. Look how hard is it to get them to upgrade to latest TLS or most modern/secure ciphersuits, and so on. If marketing can help convince them to do it a lot sooner, than god speed.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#43

Post by teacup50 »

jmathai wrote: post #11
nodata wrote: post #8

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.

> That's an enormous win.

Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has.

A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed.

Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#44

Post by patio11 »

teacup50 wrote: post #39
valarauca1 wrote: post #15

Earlier quoted context omitted.

The announcement isn't for technical folks. If you want to know the in depth details then you likely have no issue referring to bugs as numbers, or reading up on the technical details of the exploit. When you announce something you give the information in a form that the public can understand. For example if I announce a new processor, I'll announce its clock speed, number of cores. If I feel like getting in depth ca…

> The announcement isn't for technical folks. It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused. It's empty self-promoting marketing that sent the entire industry scrambling.

Any result other than "the entire industry scrambling" following the public disclosure of Heartbleed would have been a failure case. How do you imagine that working out? "We need to patch millions of servers managed by hundreds of thousands of people. It all needs to happen today, and be conducted in total secrecy, because if any bad guy finds out about what we're doing there will bet net-wide exploitation by botnets running trivial PoC code within 30 minutes. But no need to scramble, nah, let's do this with due deliberation."

Re: What Heartbleed Can Teach The OSS Community About Marketing

#45

Post by rmc »

rubiquity wrote: post #19
bhousel wrote: post #9

Maybe MITRE should assign proper names to serious CVEs, kind of like hurricanes?

Oh, great. Then in a few years we can have minor security issues given names, too. Like how winter storms this past winter were called "Polar Vortexes." This world needs less media sensationalism, not more.

Media sensationalism is important when it's a very serious issue.

Security issues of this calibre need more media sensationalism.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#46

Post by rmc »

teacup50 wrote: post #21
rubiquity wrote: post #18

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this? > Marketing Helps Accomplish Legitimate Goals Are you kidding me? The only goal of a security issue should be fixing it an…

Yes, a thousand times yes. The point isn't to market a vulnerability, the point is to get a fix out there. Forcing the entire world to scramble is great marketing, but poor security. Vendors needed time to prep releases and communications; there's tons of confusion flying around out there. Likewise, patio11's trying to capitalize on the awareness to market himself may also be great marketing, but it's bad advice. I d…

Wait, surely getting everyone to scramble is a good way to get the fix released soon?

Re: What Heartbleed Can Teach The OSS Community About Marketing

#47

Post by teacup50 »

patio11 wrote: post #44
teacup50 wrote: post #39

Earlier quoted context omitted.

> The announcement isn't for technical folks. It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused. It's empty self-promoting marketing that sent the entire industry scrambling.

Any result other than "the entire industry scrambling" following the public disclosure of Heartbleed would have been a failure case. How do you imagine that working out? "We need to patch millions of servers managed by hundreds of thousands of people. It all needs to happen today, and be conducted in total secrecy, because if any bad guy finds out about what we're doing there will bet net-wide exploitation by botnets…

You're demonstrating no understanding of how these things work.

For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, embedded hardware -- this might involve targeting quite a few different devices and testing matrixes.

Even scrambling, this can take days, and leaves users blowing in the wind in the meantime.

This is why we have coordination with vendors PRIOR to public release, such that when the vulnerability is publicly disclosed, updates are available through standard update pipelines, the process is documented, and the update is known to be correct and not introduce deployment regressions.

A vulnerability of this severity needed no marketing. Grandstanding for non-technical users simply increased the likelihood that they'd be exploited while vendors rushed out fixes.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#48

Post by teacup50 »

rmc wrote: post #46
teacup50 wrote: post #21

Earlier quoted context omitted.

Yes, a thousand times yes. The point isn't to market a vulnerability, the point is to get a fix out there. Forcing the entire world to scramble is great marketing, but poor security. Vendors needed time to prep releases and communications; there's tons of confusion flying around out there. Likewise, patio11's trying to capitalize on the awareness to market himself may also be great marketing, but it's bad advice. I d…

Wait, surely getting everyone to scramble is a good way to get the fix released soon?

No, it's a good way to get half-broken fixes rushed out the door while users are left blowing in the wind due to premature grandstanding public release.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#49

Post by aculver »

rubiquity wrote: post #18

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this? > Marketing Helps Accomplish Legitimate Goals Are you kidding me? The only goal of a security issue should be fixing it an…

Who is "the public" here? Why should package maintainers be hearing about this any sooner than me? I may not help maintain a popular Linux distribution, but I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection. (Hypothetical.) After disclosure, my only option is not to wait for a fix from my vendors and service providers, but to shut down my service (and lock out my customers) until a fix is available from them (or my own efforts) hours later. Otherwise, the bad actors who would benefit from seeing their SSL traffic would have hours to do so, and for some of us that can cost lives.

This marketing page was effective communication not just to the public, but the hundreds of thousands of technical people that needed to understand that this disclosure was different, they needed to take action, which in this world of plentiful managed hosting, is really not typical.

Post reply on HN