Why Responsible Vulnerability Disclosure Is Painful and Inefficient

A recent rant up at Attrition.org highlights problems with the responsible disclosure of security issues. While some vendors are happy to do their own research and patch reported problems, others drag their feet and make unreasonable demands on a researcher's time and effort, making anonymous public disclosure an ever-more-tempting option. Quoting: "After a couple hours of poking, I found a huge unauthenticated confidentiality hole. Once the euphoria wore off, I realized I had a big problem on my hands. I had to tell my employer's app owners and we had to assess risk and make a decision on what to do about it. After some quick meetings with stakeholders, we decided to severely limit access to the thing while we worked with the vendor. The vendor refused to acknowledge it was a security issue. Odd, considering most everyone who sees the issue unmistakably agrees that it is not acceptable. Now I'm forced to play hardball, yet nobody wants to fully-disclose and destroy relations with this vendor, whose software is somewhat relied on. Meanwhile, I know there are hundreds of institutions, small and large, using this software who have no idea that it has flawed security and who would probably not find the risk acceptable. What can I do? Nothing. Oh well, sucks to be them. ... I've had a vendor tell me to put a webapp firewall in front of their software. Did they offer to pay for it? No. That would be like Toyota telling its customers to buy ejector seats (unsubsidized ejector seats, that is) to resolve the accelerator problem in their vehicles. I've had other vendors demand I spend time helping them understand the issue, basically consulting for free for them. Have you ever knocked on a neighbor's door to tell them they left their headlights on? Did they then require you to cook them dinner? Exactly..."

Comments

Re:Hushmail and full disclosure

[NicknamesAreStupid]

What does this mean - "a moral obligation to their shareholders"? And what the hell is this - "do they have an ethical obligation"? I thought we were talking about companies. The part the makes perfect sense -- "devil's advocate." The biggest laugh - "new morality for companies and corporations." The reality -- Corporation, "if you cut me, do I not bleed?" Uh, no. Corporation, "what if I lay down my employees like cannon fodder? Do I not bleed?" Uh, no, but those people you sacrificed do. Corporation, "well, have you no sympathy for an soulless entity that is designed only for its own perpetuation with no regard for anything that it might perceive as an obstacle?" Uh, no.