Slashdot Mirror
Full Disclosure and Why Vendors Hate It
An anonymous reader writes "Well known iPhone hacker Jonathan Zdziarski gave a talk at O'Reilly's Ignite Boston 3 this week in which he called for the iPhone hacking community to embrace full disclosure and stop keeping secrets that were leading to the iPhone's demise. He has followed up with an article about full disclosure and why vendors hate it. He argues that vendor-only disclosure protects the vendors and not the consumer, and that vendors easily abuse this to downplay privacy concerns while continuing to sell insecure products. In contrast, he paints full disclosure as a capitalist means to keep the vendor accountable, and describes how public outcry can be one of the best motivating factors to get a vulnerability addressed."
It's pretty obvious since vendors have to do more work and package another release to fix bugs. It's easier to keep this information secret and just bundle all the bug fixes into a bulk package when it suits the vendor (I expect money comes into this equation somewhere).
Why UNIX?
"Women, being techically less competant then men, usually are less concerned with this"
As a man who considers himself a feminist, I find this offensive. Women in IT are always being mistreated, and we don't need that sort of thing here at slashdot.
This guy really thinks highly of himself. He claims the iPhone's "secrecy" or Apple's inattention to the "privacy flaws" have hurt the product.
Ridiculous.
The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.
I've never seen someone anywhere complain that its insecure and vulnerable to hackers.
Mac OS X and Windows XP working side by side to fight back the night.
Vendor first disclosure at least makes it LESS probable that the bad guys exploit it before a fix is available. So-called security experts disagree with this because their ego gets less press attention, but that's the main drawback.
The author seems to imply that vendor first means that a fix will take longer time. That's not obvious as all. In fact, working under the pressure of a deadline for a future disclosure is a much better motivation than to fix a problem that has already created PR damage.
I work for a vendor and so I get to see the view from the inside out on this.
Most times, when a vulnerability is discovered by a professional security group or an upstream vendor, they both tell us what it is, and propose an "embargo" date for when they plan to make it public.
This gives vendors time to react properly but still serves the public with disclosure.
This signature intentionally left unblank.
I read the article but I didn't get why he was concerned about a vendor "over-fixing" a vulnerability.
Maybe it's my cynicism about security outfits, but the only thing I could think of is that it makes it harder for them to promote themselves since it'll make it harder to find another vulnerability.
Almost no one is comfortable with full disclosure, and the ultimate arrogance and hypocrisy is demanding it in other, while fabricating excuses why your yourself cannot comply. We see this in the current US presidential campaign, where it is typical to release tax returns, but some people feel too above everyone else to so do. This includes other cases where persons who are, like the police, are paid by the american taxpayer, but refuse to fully account for their work hours to the american tax payer. the examples, private and public, are endless.
So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one. It sounds trite, and everyone always complains about the philosophy, but it works. MS is a target for viruses, even if it not inherently less secure, so I don't use it on a regular basis. SUVs are less secure as they are not inherently stuck to the ground through the tire patches, and require computer intervention to keep them for tipping over, so I don't buy them. I don't shop at stores with affinity cards. If an iPhone is an attack against security, buy something else.
Back to the issue of security, there is one serious misconception that I believe many people make. Just because one does not publish ones security details on the internet does not mean that one is practicing security by obscurity. Just because I do not publish my path to work on the net, and my schedule, and the times and places that my stuff is most venerable to theft, does not mean I practice security by obscurity or have a ideological hate of full disclosure. And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable. If the vendor does nothing about it in a fairly short time frame, then the equation shifts.
Which is why the most secure system may be open source. If something is discovered, then an slightly above average user may be able to fix it, and no one has to wait on the vendor. But open source solutions do not seem to have traction in the marketplace, so we are where we are.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
What the heck is this article about? It starts out on this tantalizing about how much personal information your iPhone retains, and then goes off into this mushy soliloquy about full disclosure. Full disclosure of what? Give us some details? Is it just that the iPhone keeps old data floating around in its flash, like every other phone? Is it doing something nasty? Please tell us!
I can't find this phrase anywhere in the article.
This article "full disclosure and why vendors hate it" is spot on! I was going to post a bit about how full disclosure is good but just RTFM.
There've been so many examples listed on slashdot alone of vendors "working with" a company only to find they either 1) Start claiming the problem is fixed when it's not 2) After a week or two, just tell the vulnerability discoverer "What problem?" and hope they go away 3) Drag out fixing it for months or years. 4) The worst.. threaten the discoverer to keep things under wraps. In an ideal world, working with the vendor is great but companies just are not ideal.
Frankly, using Apple as an example is great. They really are one of the worst companies about vulnerabilities. Not in terms of having a lot, but in how they handle them. You have them keeping flaws in wireless drivers under wraps, even threatening the author into using third party wireless hardware to demonstrate the flaw (then getting fanbois to be "Oh, it wasn't even Apple's hardware!!" when it had the same driver flaws). They've fixed security vulnerabilities secretly (people look at an upgrade to some software, and find it fixes a bunch of security flaws without the "What's new" file saying this.. fixing flaws is good, but people might not upgrade if they don't know it's important too.) They claim security flaws are not a big deal (Safari). And so on. They've been doing this for quite a long time.
Something the author doesn't mention either, but is important... the people exploiting security holes are professionals. They are paid for exploits in cold hard cash, and quite a few are looking full time. The white hats have from time to time "discovered" new vulnerabilities by finding spyware, rootkits, etc., THAT HAVE BEEN IN THE WILD FOR MONTHS, using these "new" vulnerabilities. This argues strongly that getting the vendor in a panic and fixing holes fast outweighs any keeping the hole under wraps so it's maybe not exploited so much.
You need to give responsible vendors a reasonable period of time to get a fix out. Defining "reasonable" isn't always easy but if the vulnerability truly is known only by the discoverer, a good time window will be a few hours to a few weeks, depending on the complexity of the fix, the damage that can be caused, and the risk of independent discovery.
For vendors who have proven themselves irresponsible by not delivering fixes in a timely manner, there's no point in waiting, just publish it and let market forces do their thing.
Unfortuntely, like "reasonable," defining "responsible" or "timely manner" is also not always easy.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Full Disclosure is great - but inform the vendor first.. if they don't take any action in, say, 3 days (I've used that number before - I'm sticking with it) to alleviate it, then hit the internets with it.
But too often these types are calling for Full Disclosure - immediately! Don't even bother to inform the vendor! RAR! Cry havoc, and let loose the scriptkiddies!
"The bad guy is already going to test and exploit these vulnerabilities long before the public even discovers them - the good guys ought to have a crack at verifying it too."
That is an assumption. The assumption that bad guys know about the vulnerability -before- the 'public discoverer' went with full disclosure. Plus the assumption that the bad guys' work would be as bad, or worse than, what script kiddies would do in the time between your discovery and your disclosure. I don't think those are assumption that can be made, based on - admittedly anecdotal - evidence (crashing mIRC 6.something users' IRC application on large IRC networks using a malformed DCC command only became a problem once it was disclosed and everybody and their dog started doing it, while the developer was already in the process of fixing.)
There's a middle ground - I put it at 3 days. Where do you put it, Jonathan Zdziarski? Your article seems to indicate "0 day", but I can't imagine you being that irresponsible.
Say a week elapses between the reporting a vulnerability and the passing of the embargo. That's another week that software I use is vulnerable without my knowledge thereof. If I would know that there is a problem, I would be able to take appropriate precautions while waiting for a fix, but if I don't know what's going on I'm the proverbial sitting duck. As a consumer, I demand full disclosure, and not only that, I demand to get it as soon as possible.
The issue that he raises is a flaw in capitalism, not specific to this case. Capitalism assumes that consumers have accurate information about their purchases. Making this information readily available is not encouraging capitalism, but rather trying to deny that the flaw exists.
If anything, this has the trappings of libertarian or democratic socialism. The idea of democracy taking a role in putting moral standards on powerful economic institutions, is not traditionally capitalist.
Systemd: the PulseAudio of init systems
When it comes to vulnerabilities, the vendors only care in so far as it causes a PR problem for them. However, I don't believe that these "Security Experts" are crusading for consumers either. They tell the company that there is a problem, but if the company doesn't decided that the flaw "They" found is the most important thing then the "Security Expert" throws a hissy fit and tells everyone about it in revenge. The "Security Expert" appears to me to be hoping someone will develop some malware that utilizes the flaw and gives the vendor a PR problem. Either way it's the consumer that looses because in the case of unfixed flaws there exists the possibility of a Malware author discovering the flaw, and in the event of full disclosure the consumers are the ones at risk if the malware authors act faster than the vendor. IMHO, It's a pissing contest between the vendors that write the software and the "Security Experts" that want bragging rights.
Bureaucracy expands to meet the needs of the expanding bureaucracy.-Oscar Wilde
I will embrace and celebrate the death of this device.
Verizon's open platform is going to have more full disclosure.
He argues that if there is not full disclosure and you just notify the vendors that the bad guys will "probably" know about it too. If that was wide spread then you wouldn't have people reverse engineering the monthly Windows patches to figure out what was patched. There are many crackers doing this every time Microsoft comes out with new updates and then they use that information to exploit people who haven't patched.
If the exploits were fully disclosed instead then most likely there would be even more exploits in the wild.
Vendor first doesn't mean "vendor only", and nobody says you need to sit on a flaw forever if the vendor doesn't fix it. You're giving them advance notice, not carte blanche.
Guess who is sleeping on the couch tonight.
-Stereotype party! Apparently now, it's OK to fight stereotypes with stereotypes. Cool!
"because male techs tend to have limited interests and are difficult to work with when you're female"
In MY experience, women in IT WANT to be treated differently. They think ovaries make them special. I guess personal experience can vary, huh? Let's not even get into the abuses of playing the "sexual harrassment" card...
"It's the atmosphere."
In MY experience, it really IS the atmosphere. If some of the women I've worked with weren't able to "play" in the gossipy, catty, back-biting, in-fighting environments they enjoy, then they don't want to play at all.
Goody! Goody! That was fun. Now let's do stereotypes about blacks and jews. You go first...