Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Zero – Policy and Disclosure: 2025 Edition

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Project Zero – Policy and Disclosure: 2025 Edition

#31

Post by mananaysiempre »

some_furry wrote: post #26
runningmike wrote: post #25

It is indeed a complex problem. But is Google now killing FOSS slowly? IMHO there is far too much emphasis on Foss security and far too little on closed sourced hardware, firmware and software. Too much blame and pressure will not solve the complex problems as stated in the blog.

Shoring up the security of FOSS is not "killing FOSS slowly". Closed source software doesn't get to benefit from the goodwill of the open source software community, which includes independent security researchers as well as orgs like P0. I guess our disagreement can be distilled down to one question: Why would an emphasis on closed source products help FOSS, and why would an emphasis on FOSS help closed source? Becau…

It depends on the maintainer, some of them have indeed found themselves unwilling to continue their work in part because of Project Zero.

> I just stepped down as libxslt maintainer and it's unlikely that this project will ever be maintained again. It's even more unlikely with Google Project Zero, the best white-hat security researchers money can buy, breathing down the necks of volunteers.

https://gitlab.gnome.org/GNOME/libxml2/-/issues/913

Re: Project Zero – Policy and Disclosure: 2025 Edition

#32

Post by tptacek »

mananaysiempre wrote: post #31
some_furry wrote: post #26

Earlier quoted context omitted.

Shoring up the security of FOSS is not "killing FOSS slowly". Closed source software doesn't get to benefit from the goodwill of the open source software community, which includes independent security researchers as well as orgs like P0. I guess our disagreement can be distilled down to one question: Why would an emphasis on closed source products help FOSS, and why would an emphasis on FOSS help closed source? Becau…

It depends on the maintainer, some of them have indeed found themselves unwilling to continue their work in part because of Project Zero. > I just stepped down as libxslt maintainer and it's unlikely that this project will ever be maintained again. It's even more unlikely with Google Project Zero, the best white-hat security researchers money can buy, breathing down the necks of volunteers. https://gitlab.gnome.org/G…

I know it's hard to believe this given the circumstances --- that maintainer has a very good reason for stepping back, absolutely no shade to give there --- but GPZ is doing a service for these projects. The vulnerabilities they find are there whether or not Google or anybody else steps up on the implementation side. They are simple facts of the software, and it's difficult, expensive, and important to uncover those facts.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#33

Post by mananaysiempre »

tptacek wrote: post #32
mananaysiempre wrote: post #31

Earlier quoted context omitted.

It depends on the maintainer, some of them have indeed found themselves unwilling to continue their work in part because of Project Zero. > I just stepped down as libxslt maintainer and it's unlikely that this project will ever be maintained again. It's even more unlikely with Google Project Zero, the best white-hat security researchers money can buy, breathing down the necks of volunteers. https://gitlab.gnome.org/G…

I know it's hard to believe this given the circumstances --- that maintainer has a very good reason for stepping back, absolutely no shade to give there --- but GPZ is doing a service for these projects. The vulnerabilities they find are there whether or not Google or anybody else steps up on the implementation side. They are simple facts of the software, and it's difficult, expensive, and important to uncover those…

Both can be true at the same time, I think. It’s true that the vulnerabilities exist regardless of whether anyone’s reporting them, and that it’s better to know about them than not. It’s also true that almost any course of action that makes a project effectively stop existing does it a disservice, and that includes vulnerability reporting.

I’ve not really made up my mind about what happened with libxml2, to be clear. Perhaps in this world some projects really are vulnerable enough that they deserve to die. But as we see, this can entail essentially punishing people who decide to take up e.g. parsers as a hobby. And not doing that is something I feel I value higher than even security of the software ecosystem as a whole.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#34

Post by some_furry »

mananaysiempre wrote: post #33
tptacek wrote: post #32

Earlier quoted context omitted.

I know it's hard to believe this given the circumstances --- that maintainer has a very good reason for stepping back, absolutely no shade to give there --- but GPZ is doing a service for these projects. The vulnerabilities they find are there whether or not Google or anybody else steps up on the implementation side. They are simple facts of the software, and it's difficult, expensive, and important to uncover those…

Both can be true at the same time, I think. It’s true that the vulnerabilities exist regardless of whether anyone’s reporting them, and that it’s better to know about them than not. It’s also true that almost any course of action that makes a project effectively stop existing does it a disservice, and that includes vulnerability reporting. I’ve not really made up my mind about what happened with libxml2, to be clear.…

There seems to be a missing component:

Some open source software becomes critical infrastructure for a large part of the Internet, and that comes with a lot of responsibility that the maintainer didn't necessarily want to sign up for. Especially when it's unpaid labor with the demands of a large tech company hammering down on them.

How can we better support the people that run these projects? How can we take pressure off of them if they don't want it?

There isn't a one-size-fits-all solution here, I don't think. But I'm sure some combination of fund open source development and fork load-bearing projects that do not wish to be encumbered is going to be necessary for a lot of the community.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#35

Post by amiga386 »

perching_aix wrote: post #29
diggan wrote: post #6

Earlier quoted context omitted.

This was published the day after, with the title "Problems with the heap" but the URL makes the context clear: https://rachelbythebay.com/w/2025/03/26/atop/

Yeah, I meant since that one.

A bug matching the details of the vaguepost was found by a third party with no help from Rachel: https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug

> Given the vagueness, we were curious if Bismuth's bug scanning capabilities could find the bug so we let it rip on the code base. 10 minutes later, we had it. Or at least we had a bug which looked and behaved exactly like Rachel described.

> As soon as we figured this out and had something reproducible we moved to responsibly disclose the issue and we emailed Gerlof at 8pm on the 26th.

> Seeing this bug and how it's triggered, I understand Rachel's initial reaction to write a vague "get rid of it" post without going into detail. [...] That said, the internet loves to run wild with speculation and there's a reason we have the responsible disclosure process. For something that's installed as often as Nvidia GPU drivers, it would be prudent to spend the extra few days and have a controlled disclosure. Posting something like that can start off an arms race to find the bug, and if someone malicious were to reproduce and exploit it first, they get free reign to take over affected systems until it's patched. Yes, sounding the alarm might cause people to uninstall it, but there's plenty of places where it will remain, giving malicious actors incentive to go for it. But with a coordinated disclosure, the arms race never starts, and systems are patched before anyone realizes there was an issue.

The atop maintainer fixed the bug on March 29th, and also changed the behaviour of atop to _not_ connect to its helper daemons by default: https://github.com/Atoptool/atop/commit/542b7f7ac52926ca2721... ... and released it as atop v2.11.1 on April 5th: https://github.com/Atoptool/atop/releases/tag/v2.11.1

There has been nothing on Rachel's blog about this topic since the vaguepost and vaguepost followup.

The CVE (https://www.cve.org/CVERecord?id=CVE-2025-31160) is still incorrect, and there's no indication who requested it. It says that versions "0 - 2.11.0" are affected, this is untrue, because the atopgpud (and support in atop for reading from it) was introduced in version 2.4.0 ("The vulnerability is present since the introduction of 'atopgpud' in atop 2.4.0." per https://www.atoptool.nl/downloadatop.php)

Re: Project Zero – Policy and Disclosure: 2025 Edition

#36

Post by amiga386 »

tptacek wrote: post #28
amiga386 wrote: post #13

Earlier quoted context omitted.

I stand by what I said at the time: https://news.ycombinator.com/item?id=43492940 - and if you only read one thing, read the harrassment an atop contributor was subjected to by "eslerm": https://github.com/Atoptool/atop/issues/330#issuecomment-275... I bring it up because of the unmissable parallels. Google are trialling a policy to see what will happen, but this incident shows already what can happen. RbtB is a trus…

The "Rachel By The Bay" blog and Google Project Zero are not reasonable comparands in matters of vulnerability disclosure.

I think it's a fair illustration of what irresponsible disclosure looks like.

I expect Project Zero will be monitoring carefully; for all their good intentions, this policy trial has the potential to go as badly wrong as the atop disclosure did, for everything they announce.

You can reasonably expect massive, worldwide scrutiny in anything P0 announces has a vulnerability in it without also disclosing the vulnerability, and this extra attention has the potential to overwhelm FOSS maintainers, even if they have fixed the vulnerability and are waiting for coordinated disclosure.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#37

Post by tptacek »

amiga386 wrote: post #36
tptacek wrote: post #28

Earlier quoted context omitted.

The "Rachel By The Bay" blog and Google Project Zero are not reasonable comparands in matters of vulnerability disclosure.

I think it's a fair illustration of what irresponsible disclosure looks like. I expect Project Zero will be monitoring carefully; for all their good intentions, this policy trial has the potential to go as badly wrong as the atop disclosure did, for everything they announce. You can reasonably expect massive, worldwide scrutiny in anything P0 announces has a vulnerability in it without also disclosing the vulnerabili…

"Responsible disclosure" is an Orwellian term made up by vendors to coerce vulnerability researchers into working for and on vendor release schedules.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#38

Post by amiga386 »

tptacek wrote: post #37
amiga386 wrote: post #36

Earlier quoted context omitted.

I think it's a fair illustration of what irresponsible disclosure looks like. I expect Project Zero will be monitoring carefully; for all their good intentions, this policy trial has the potential to go as badly wrong as the atop disclosure did, for everything they announce. You can reasonably expect massive, worldwide scrutiny in anything P0 announces has a vulnerability in it without also disclosing the vulnerabili…

"Responsible disclosure" is an Orwellian term made up by vendors to coerce vulnerability researchers into working for and on vendor release schedules.

Did you not see the panicked, stupid, wrong mob that the vaguepost whipped up, with your own eyes? It is very easy to whip up a mob: 1) be well regarded and trusted, and 2) post a vague statement about a specific target (e.g. "you might want to stop running atop") where a lot of people will see it. The mob will then form, start speculating, and a pile of them won't be able to help themselves and will start picking over every single thing in the repository. "Is this the bug?" "No." "Is this the bug?" "No." "This contributor is Jia Tan, isn't he?" "No they are not." and so on.

Maintainers always welcome genuine security reports, and especially love a working PoC. But they don't have time to deal with idiots, spammers, shysters and chancers who submit bullshit reports, or ask for hand-holding to submit what will turn out to be bullshit reports, and they definitely don't have time to engage in idle speculation. It wastes their time, and reduces the time they have to look at what could be genuine reports.

Imagine what would happen if Project Zero posted "you might want to stop running ffmpeg" with no further details. That's effectively what's being proposed. A million idiots descend upon the project with "Hey guys I heard Project Zero found a vulnerability in ffmpeg. How exciting! Is it this free(NULL)?"

There is nothing wrong with responsible and coordinated disclosures, even if vendors take liberties, and yes you should set an upper bound for disclosure. But if your policy is "I will disclose to the public that I found a bug in specific software, but not what the bug is", accept that you are likely to unleash chaos, especially if you are a well-regarded and trusted researcher.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#39

Post by tptacek »

amiga386 wrote: post #38
tptacek wrote: post #37

Earlier quoted context omitted.

"Responsible disclosure" is an Orwellian term made up by vendors to coerce vulnerability researchers into working for and on vendor release schedules.

Did you not see the panicked, stupid, wrong mob that the vaguepost whipped up, with your own eyes? It is very easy to whip up a mob: 1) be well regarded and trusted, and 2) post a vague statement about a specific target (e.g. "you might want to stop running atop") where a lot of people will see it. The mob will then form, start speculating, and a pile of them won't be able to help themselves and will start picking ov…

Again, simply not interested in comparisons between GPZ and the Rachel By the Bay blog.

Re: Project Zero – Policy and Disclosure: 2025 Edition

#40

Post by amiga386 »

tptacek wrote: post #39
amiga386 wrote: post #38

Earlier quoted context omitted.

Did you not see the panicked, stupid, wrong mob that the vaguepost whipped up, with your own eyes? It is very easy to whip up a mob: 1) be well regarded and trusted, and 2) post a vague statement about a specific target (e.g. "you might want to stop running atop") where a lot of people will see it. The mob will then form, start speculating, and a pile of them won't be able to help themselves and will start picking ov…

Again, simply not interested in comparisons between GPZ and the Rachel By the Bay blog.

We're going round in circles now, so let's just say we will see what happens.

Project Zero seems upbeat, but acknowledges this risk:

> We understand that for some vendors without a downstream ecosystem, this policy may create unwelcome noise and attention

> This is a trial, and we will be closely monitoring its effects.

They don't explicity spell out what they would consider a failure of this policy trial. I think failure would look like the example I have outlined, but at greater scale.

Post reply on HN