Slashdot Mirror
Heartbleed Sparks 'Responsible' Disclosure Debate
bennyboy64 writes: "IT security industry experts are beginning to turn on Google and OpenSSL, questioning whether the Heartbleed bug was disclosed 'responsibly.' A number of selective leaks to Facebook, Akamai, and CloudFlare occurred prior to disclosure on April 7. A separate, informal pre-notification program run by Red Hat on behalf OpenSSL to Linux and Unix operating system distributions also occurred. But router manufacturers and VPN appliance makers Cisco and Juniper had no heads up. Nor did large web entities such as Amazon Web Services, Twitter, Yahoo, Tumblr and GoDaddy, just to name a few. The Sydney Morning Herald has spoken to many people who think Google should've told OpenSSL as soon as it uncovered the critical OpenSSL bug in March, and not as late as it did on April 1. The National Cyber Security Centre Finland (NCSC-FI), which reported the bug to OpenSSL after Google, on April 7, which spurred the rushed public disclosure by OpenSSL, also thinks it was handled incorrectly. Jussi Eronen, of NCSC-FI, said Heartbleed should have continued to remain a secret and be shared only in security circles when OpenSSL received a second bug report from the Finnish cyber security center that it was passing on from security testing firm Codenomicon. 'This would have minimized the exposure to the vulnerability for end users,' Mr. Eronen said, adding that 'many websites would already have patched' by the time it was made public if this procedure was followed."
This really strikes me as the type of problem that will never have a good solution. There will always be competing interests and some of them will be mutually exclusive while still being valid concerns.
Open source software is often made freely available at no costs to downloaders and embedders. There is little incentive for these users to pay anything for it, including for support, since the main reason to adopt this software is to not pay at all. The result is that there are few resources for testing or documenting the software and no incentive for the developers to care about the usage by others and actively develop the software outside of their own use cases.
Further aggravating the issue is the claim by activists that the software code is reviewed by millions of people as it is freely available to anyone. The fallacy of this claim resides in the lack of interest of anyone to do this. Indeed, who would review other people's code for free or for fun? Vulnerabilities such as the Heartbleed bug are always found by using and probing the software, not by reviewing the code.
OpenSSL and the Hearbleed bug is the new poster child for the failed open source movement. No one cared, no one will care. Repeat expected.
The only possible way is to disclose to the responsible manufacturer (OpenSSL) and nobody else first, then, after a delay given to the manufacturer to fix the issue, disclose to everybody. Nothing else works. All disclosures to others have a high risk of leaking. (The one to the manufacturer also has a risk of leaking, but that cannot be avoided.)
The other thing is that as soon as a patch is out, the problem needs to be disclosed immediately by the manufacturer to everybody (just saying "fixed critical security bug" is fine), as the black-hats watch patches and will start exploiting very soon after.
All this is well known. Why is this even being discussed? Are people so terminally stupid that they need to tell some "buddies"? Nobody giving out advance warnings to anybody besides the manufacturer deserves to be in the security industry in the first place as they do not get it at all or do not care about security in the first place.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
These guys are apparently competent enough to find a bug like this. The fix is damned near trivial. So "disclose" it to OpenSSL, accompanied by a patch and let OpenSSL do the rest.
Lite a fire under everyone butts and it got fixed and deployed in hours. I see nothing wrong with this. Maybe it's time to crank up the heat.
This notion ranks right up there. Manufacturer was told. Everybody else was then told. That's how it's supposed to work. This notion of "let's just tell our close friends and leave everybody else in the dark" is silly. You'd only wind up leaving most people open to exploit, because if you think your secret squirrel society of researchers doesn't have leaks, you're deluding yourself.
Easy Online Role Playing Campaign Management
There should have been a public advisory telling everybody with an OpenSSL based server to shut down the server, wait for an update, install the update and only then put the server online again. The biggest mistake was to keep vulnerable servers running for even a short while after the vulnerability was published.
And how do you differentiate between "web sites" and "end users"? Why should Facebook be treated differently than me?
feed the innocent starving diaper addicts. free the innocent stem cells. we'll all feel better. good sports with good spirits should know better stuff..
>> Google notified OpenSSL about the bug on April 1 in the US – at least 11 days after discovering it.
"OK, maybe it was caught up in legal. Suits at large corporations can take a while."
>> Google would not reveal the exact date it found the bug, but logs show it created a patch on March 21,
"On second thought, if the geeks on the ground had the authority to patch and roll to production, then why the finger to the Open Source community, Google?"
What exactly is the issue here? Maybe I misread TFS and the linked articles, but as I understand the chief complaint - apart from Google's delay in reporting to OpenSSL - is that some large commercial entities did not receive a notification before public disclosure. I did not dig all too deep into the whole issue, but as far as I can tell OpenSSL issued their advisory in lieu with a patched version. What more do they expect? And why should "Cisco[,] Juniper[,] Amazon Web Services, Twitter, Yahoo, Tumblr and GoDaddy" get a heads-up on the public disclosure? I did not get a heads-up either. Neither did the dozens or so websites not named above that I use. Neither did the governmental agency I serve with. Nor the bank whose online-banking portal I use. Are we all second-class citizens? Does our security matter less simply because we provide services to fewer people, or bring lower or no value to the exchange?
A bug was reported, a fix was issued, recommendations for threat mitigation were published. There will need to be consequences for the FLOSS development model to reduce the risk for future issues of the sort, but beyond that I do not quite understand the fuss. Can someone enlighten me please?
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
IT security industry experts are beginning to turn on Google and OpenSSL, questioning whether the Heartbleed bug was disclosed 'responsibly.
Are you fucking kidding me? What kind of so-called "experts" are these morons?
Newflash: The vast majority of 0-days are known in the underground long before they are disclosed publicly. In fact, quite a few exploits are found because - drumroll - they are actively being exploited in the wild and someone's honeypot is hit or a forensic analysis turns it up.
Unless you have really, really good reasons to assume that this bug is unknown even to people whose day-to-day business is to find these kinds of bugs, there is nothing "responsible" in delaying disclosure. So what if a few script-kiddies can now rush a script and do some shit? Every day you wait is one day less for the script kiddies, but one day more for the real criminals.
Stop living in la-la-land or in 1985. The evil people on the Internet aren't curious teenagers anymore, but large-scale organized crime. If you think they need to read advisories to find exploits, you're living under a rock.
Assorted stuff I do sometimes: Lemuria.org
and not NSA who found the bug 4 years ago when the bug was first introduced?
Yeah, if they knew it was a problem and patched it, then they should have submitted a patch to OpenSSL as soon as possible. I assume one of the engineers involved wanted to sell the vulnerability.
Once again the evil of Information Disparity rares its ugly head. To maximize freedom and equality entities must be able to decide and act by sensing the true state of the universe, thus knowledge should be propagated at maximum speed to all; Any rule to the contrary goes against the nature of the universe itself.
They who seek to manipulate the flow of information wield the oppression of enforced ignorance against others despite their motive for doing so. The delayed disclosure of this bug would not change the required course of action. The keys will need to be replaced anyway. We have no idea whether they were stolen or not. We don't know who else knew about this exploit. Responsible disclosure is essentially lying by omission to the world. That is evil as it stems from the root of all evil: Information Disparity. The sooner one can patch their systems the better. I run my own servers. Responsible disclosure would allow others to become more aware than I am. Why should I trust them not to exploit me if I am their competitors or vocal opponent? No one should decide who should be their equals.
Fools. Don't you see? Responsible disclosure is the first step down a dangerous path whereby freely sharing important information can be outlawed. The next step is legislation to penalize the propagators of "dangerous" information, whatever that means. A few steps later will have "dangerous" software and algorithms outlawed for national security, of course. If you continue down this path soon only certain certified and government approved individuals will be granted license to craft certain kinds of software, and ultimately all computation and information propagation itself will be firmly controlled by the powerful and corrupt. For fear of them taking a mile I would rather not give one inch. Folks are already in jail for changing a munged URL by accident and discovering security flaws. What idiot wants to live in a world where even such "security research" done offline is made illegal? That is where Responsible Disclosure attempts to take us.
Just as I would assume others innocent unless proven guilty of harm to ensure freedom, even though it would mean some crimes will go unpunished: I would accept that some information will make our lives harder, some data may even allow the malicious to have a temporary unfair advantage over us, but the alternative is to simply allow even fewer potentially malicious actors to have an even greater power of unfair advantage over even more of us. I would rather know that my Windows box is vulnerable and possibly put a filter in my IDS than trust Microsoft to fix things, or excuse the NSA's purchasing of black-market exploits without disclosing them to their citizens. I would rather know OpenSSL may leak my information and simply recompile it without the heartbeat option immediately than trust strangers to do what's best for me if they decide to not do something worse.
There is no such thing as unique genius. Einstein, Feynman, and Hawking, did not live in a vacuum; Removed from society all their lives they'd have not made their discoveries. Others invariably picked up from the same available starting points and solve the same problems. Without Edison we would still have electricity and the light bulb. Without Alexander Bell we would have had to wait one hour for the next telephone to enter the patent office. Whomever discovered this bug and came forward has no proof that others did not already know of its existence.
Just like the government fosters secrecy of patent applications and reserves their right to exclusive optioning of newly patented technology, if Google had been required keep the exploit secret except to government agencies we may never have found out about heartbleed in the first place. Our ignorance enforced, we would have no other choice but to keep our systems vulnerable. Anyone who thinks hanging our heads in the noose of responsible disclosure a good idea is a damned fool.
The real scandal is how organisations are giving information to their users as to how they are affected and what users should do. Many big-name companies are using very specific phrasing such as "key services were not vulnerable", but no mention of secondary services...sounds like a liar's hiding place to me. There are also far too many who don't understand the problem such as Acronis, the Aus bank etc. Then the likes of Akamai who can't make their mind up. Some irresponsibly down-playing the whole thing and of course, the majority of the rest who haven't said sweet FA. In the middle are the poor people who can't be expected to make informed decisions on what they need to do or how exposed they are.
You thought rfc-ignorant, abuse@ ignoring fuckwits, running their company around the Internet with Flash-only sites was bad? This is what happens when their incompetence starts to actually harm people's online security.
That is the biggest problem. Other then rewarding the people who fix the problem, we try to figure out who is to blame for every freaking thing.
Oh look a flood hit the city unexpected, well lets blame the mayor for not thinking about this unexpected incident.
Or a random guy blew up something, why didn't the CIA/NSA/FBI know that he was doing this...
We are trying to point blame on too many things, and less time trying to solve the problem.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Selective leaks to friends, screw over the competitors.
They've set the precedent now - time to sit back and watch them get burned by it in the future.
Invited b4ck again. Al7 along. *BSD
If this hadn't been publicly disclosed, it would have just gone into the 0-day libraries which Intelligence agencies around the globe have been amassing. We'd never learn we were vulnerable, and their ability to impersonate and eavsdrop would have increased beyond any reasonably-articulatable expectation.
Responsible disclosure to sufficient parties to address the issue would also expose it to potential attackers, and there will always be players with need-to-know who won't be identified for notification.
The fact that OpenSSL is open source and had a trivial mistake that exposed the entirety of the Internet's encrypted traffic to easy eavesdropping for years should be a clue to how trustworthy open source software can be.
This is a common and well known americanism related to a complex interaction between hierarchal socialism, legality, and the fact you westerns seem to think the best way to repent for making mistakes is to dump it all on someone else either by means of blame or legal charges (most commonly in ameica in the form of suing others). Good luck changing that.
In the east people gain face by solving problems succinctly and gracefully, without making the kind of fuss westerners do when something goes wrong. As opposed to finding ways to make others lose face because they made a mistake.
This could probably also be summed up as a comparison of authoritarianism (west focuses on self and power) vs. communism (east focuses on the big picture and the community)
> and not as late as it did on April 1
That must have been the most expensive April Fool's joke EVER.
-f
Are you fucking kidding me? What kind of so-called "experts" are these morons?
Newflash: The vast majority of 0-days are known in the underground long before they are disclosed publicly.
But "the underground" is not some monolithic entity. It's spread out over the entire planet and over tens (hundreds?) of thousands of people. Some may know about a particular exploit and some may not. Once you announce it however, everyone does know it.
So by allowing the vendor 1-2 weeks to issue a patch, you contain the exploit from being used by 100% of "the underground", to 'only' 0.001/1/2/5/7/10/33/whatever percent. If there's only a dozen guys in the Republic of Elbonia that know it, that's different then the entire Russian mafia and/or the Chinese cyber-army knowing.
Scale matters.
However, no matter how you look at it, the number of people who actually do will always be equal or higher than for closed source software.
Upon what data is this assumption based? How many people have reviewed the code behind Microsoft's BitLocker vs. how many have reviewed the code for TrueCrypt, for example? The real question is how many QUALIFIED people are reviewing the code. In the case of OpenSSL it appears the answer was ONE (and they missed a trivial mistake).
The only thing you do by hiding this kind of information is limit the number of heads working to fix it. I'm tired of these attempts at plugging the hole in the dam by pretending the hole isn't there until someone plugs it.
Look, Google knew it. Google is part of prism. You are still wondering, if the NSA may have used Heartbleed?
> Indeed, who would review other people's code for free or for fun?
Some people do, of course. I have, specifically for security issues, because that's a major resume point in the security world - having actually found and fixed real-world security issues.
99% of the time, I'm being paid to review and improve open source code. All of those companies that use open source, including Google, have a vested interest in making sure that the code they use is good. Since it's open source, the Google techs can actually dig into the code and find issues like this, then fix it, just like they did in this case. They didn't do it for free and for fun, they did it because Google relies on OpenSSL.
My employer also relies on OSS. My job is to administer, maintain, and improve the OSS software we use. I've found and fixed security issues. Not for free and for fun, but because we want our systems to be secure, and having the source allows me to do that.
When I craft an improvement, at LEAST three people have to look at it before it's committed upstream. Typically, five or six people will comment on it and suggest improvements or state their approval before it's finalized.
Once the discoverer of the bug patched their own servers and the software creator has an official fix, the only ethical thing is to tell everyone at once. It is not realistic to expect a secret to be kept in a dozen independent companies with thousands of employees each. Also, why should Facebook get an unfair business advantage over Yahoo? Most users having dozens of accounts where overlapping private information is stored and get no benefit from just one server being patched.
Make sure a fix is available and then publish quickly so that bad actors have less time to develop exploits.
This was handled similarly to a flaw I discovered, and I think it makes sense. Facebook, for example, has about a billion users. If you have a colleague you trust at Facebook, informing that one colleague can protect Facebook's billion users.
The risk is of a leak before a fix is widely deployed is dependent on a) the number of people you inform and b) how trustworthy those people are to keep quiet for a couple of days. It's quite reasonable to minimize the risk of a leak by keeping it low profile for a few days, while minimizing the damage by protecting as many people as possible.
For CVE-2012-0206 , developers knew that wikimedia was the largest user. Wikipedia and related properties account for over half the the end-users that could be affected. So by letting just one person know about it ahead of time, we could protect millions of wikipedia users. That seems like a good trade, so we let wikipedia have the patch 24 hours before the main distros like Red Hat put the patch out publicly and the vulnerability became well known. Nobody was harmed by hearing about it on Tuesday rather than on Monday, and all of wikipedia's users were protected from being affected by keeping it secret for a day while wikipedia's servers were patched.
Historically, so-called "responsible disclosure" has resulted in delayed fixes. As long as the flaw is not public and causing a drum-beat of demands for a fix and a possible loss of customers, the developer organization too often treats security vulnerabilities the same as any other bug.
Worse, those who report security vulnerabilities responsibly and later go public because the fixes are excessively delayed often find themselves branded as villains instead of heroes. Consider the case of Michael Lynn and Cisco in 2005. Lynn informed Cisco of a vulnerability in Cisco's routers. When Cisco failed to fully inform its customers of the significance of the security patch, Lynn decided to go public at the 2005 Black Hat conference in Las Vegas. Cisco pressured Lynn's employer to fire him and also filed a lawsuit against Lynn.
Then there was the 2011 case of Patrick Webster, who notified the Pillar Administration (major administrator of retirement plans in Australia) of a security vulnerability in their server. When the Pillar Administration ignored Webster, he used the vulnerability to extract personal data from about 500 accounts from his own pension plan (a client of the Pillar Administration). Webster made no use of the extracted personal data, did not disseminate the data, and did not go public. He merely sent the data to the Pillar Administration to prove the existence of the vulnerability. As a result, the Pillar Administration notified Webster's own pension plan, which in turn filed a criminal complaint against Webster. Further, his pension plan then demanded that Webster reimburse them for the cost of fixing the vulnerability and sent letters to other account holders, implying that Webster caused the security vulnerability.
For more details, see my "Shoot the Messenger or Why Internet Security Eludes Us" at http://www.rossde.com/editoria....
If i find a bug which is critical to my employer while being plaid by my employer, the first and only thing which is do is assess the impact to my emplyer, and identify the most important measures for the employers business.
IMHO they acted correctly: protect your own systems, and then the systems with the biggest impact.
Nobody was harmed by hearing about it on Tuesday rather than on Monday
Isn't that assumption where the whole argument for notifying selected parties in advance breaks down?
If you notify OpenSSL, and they push a patch out in the normal way, then anyone on the appropriate security mailing list has the chance to apply that patch immediately. Realistically, particularly for smaller organisations, it will often be applied when their distro's mirrors pick it up, but that was typically within a couple of hours for Heartbleed, as the security and backporting guys did a great job at basically all of the main distros on this one.
As soon as you start picking and choosing who else to tell first, yes, maybe you protect some large sites, but those large sites are run by large groups of people. For one thing, they probably have full time security staff who will get the notification as soon as it's published, understand its significance, and act on it immediately. For another thing, they probably have good automated deployment systems that will systematically patch all their affected servers reliably and quickly.
(I accept that this doesn't apply to those who have products with embedded networking software, like the Cisco and Juniper cases. But they can still issue patches to close the vulnerability quickly, and the kinds of people running high-end networking hardware that is accessible from outside a firewall are also probably going to apply their patches reasonably quickly.)
On the flip side, as long as you're giving advance warning to those high profile organisations, you're leaving everyone else unprotected. In this case, it appears that at least two different parties identified the vulnerability within a few days of each other, but the vulnerability had been present for much longer. There is no guarantee that others didn't already know about it and weren't already exploiting it. In general, though it may not apply in this specific case, if some common factor prompted the two contemporaneous discoveries, it might well be the case that additional, hostile parties have found it around the same time too.
In other words, you can't possibly know that nobody was harmed by hearing about it a day later. If a hostile party got hold of the vulnerability on the first day, maybe prompted by whatever also caused the benevolent parties to discover it or by some insider information, then they had a whole day to attack everyone who wasn't blessed with the early knowledge, instead of a couple of hours. This is not a good thing.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
This was handled similarly to a flaw I discovered, and I think it makes sense. Facebook, for example, has about a billion users. If you have a colleague you trust at Facebook, informing that one colleague can protect Facebook's billion users.
Ah yes, the duckface pictures of a bunch of teens are way more important than, let's say, millions of tax returns.
I'm not a complete idiot... Some parts are missing.
The whole point of OSS is that I do not need to trust it. I can review it if I please.
But you didn't review it and find the vulnerability, did you?
And apparently, despite the significance and widespread use of this particular piece of OSS, for a long time no-one else did either, or at least no-one who's on our side did.
Your argument is based on theory. The AC's point is based on pragmatism. It's potentially an advantage that OSS can be reviewed by anyone, but a lot of the time that gives a false sense of security. What matters isn't what could happen, it's what actually does happen.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
This is foolish when you apply a patch to an open source project it essentially becomes public knowledge to anyone who is paying attention at that point. The more you do this the more eyes on patches. This only yields ignorance and suppresses urgency.
Only telling a select few (normally by subscription to very expensive security services) gives giant media an advantage it is not clear to me they have a right to or in any way deserve.
Finally as much money locked up in black/gray hat activities we don't need to be enriching anyone for contributing to an industry of an elite few none of us have any reason to trust.
Behavior of crowd at recent BlackHat toward Mr. Alexander made crystal clear to me kids have all grown up and money runs the show now. The more money the more "ethics" bend towards production of additional money.
Nobody was harmed by hearing about it on Tuesday rather than on Monday
Are you absolutely sure about that? Completely positive?
I suspect more than zero people were if not harmed then defiantly harmed further by such a situation.
Yes, you can easily marginalize the small percentage of people who were exploitable by black hats for 371 days instead of only 370 days as the case was, but just because 1/370 is a small fraction doesn't mean it is zero - people attacked using this exploit in the prior 370 days to Google announcing it would certainly disagree with you about the number of days notice they got - and the 1/370 percentage of people being exploited either again or for the first time on that last day would also disagree with you.
Remember, just because it was first discovered by the white hats at Google just this year does NOT mean this exploit wasn't being actively exploited in the underground for hundreds of days already - because they were.
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
One thing I haven't heard discussed is whether affected companies should be notifying their end users about whether they were affected and when it was fixed. I haven't heard from my bank, for example. Where they ever vulnerable? Should I update my password? If they were vulnerable, is it fixed now or would I just be handing an attacker my new password if I were to reset it today?
I wrote up a proposal called Heartbleed headers for communicating this information to site visitors. While I'd like it if everyone picked my idea as the new standard way for doing this, I just wish admins would start using something. We're so close to having a browser plugin be able to tell you "you need to update your password on this site" as you browse. How nice would that be?
Dewey, what part of this looks like authorities should be involved?
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
> they had a whole day to attack everyone who wasn't blessed with the early knowledge, instead of a couple of hours
Years, not hours. Assuming the bad guys knew about it, they had two YEARS to attack people. If we told people that there was an issue on Monday, that doesn't protect them - they just know that their vulnerable. They couldn't do anything about it until the update packages were available on Tuesday.
On the other hand, had we made it public on Monday, we would have GUARANTEED that lots of bad guys knew about it, during a period in which everyone was vulnerable.
I'm talking about what we did here. It appears to me that Google definitely screwed up by not telling the right people on the OpenSSL team much sooner. (Apparently they told _someone_ involved with OpenSSL right away, but not the right soemone.)
> you protect some large sites, but those large sites are run by large groups of people. For one thing, they probably have full time security staff who will get the notification as soon as it's published, understand its significance, and act on it immediately.
ROTFL. Yep, large corporate bureaucracies, they ALWAYS do exactly the right thing, in a matter of hours.
> Isn't that assumption where the whole argument for notifying selected parties in advance breaks down? ...
> it will often be applied when their distro's mirrors pick it up, but that was typically within a couple of hours for Heartbleed
How do you think those packages get on the mirrors? Do their servers magically patch the code, rebuild the packages, and set it as a high priority update? The fix gets on the mirrors as a result of "notifying selected parties in advance".
There is no option that's going to protect those tax returns. Telling the bad guys about it will certainly endanger the tax return data, though.
Since many (most?) people use the same or similar password for Facebook as they use for their tax service, protecting Facebook traffic actually protects a few tax returns.
What clearly isn't an effective option would be to announce the vulnerability to hundreds of tax-preparer sites before a updated package is available, expecting them to manually (and correctly) patch the code, without leaking the vulnerability so that it becomes widely known to the bad guys.
If you're going to try to protect people in the time between discovery and the fix being widely distributed, you can only do that by keeping it relatively secret, by limiting details to a small number of trusted people. Once you tell a lot of people, you've told a lot of bad guys. There's no need to do that before the updates are available and people can protect their customers.
Contact the developers first, let them know that they need to notify the security groups by a certain date as you will be doing so as well on that date.
If they notify first, great, if not, then you know they chose not to, and it's good that you did.
I'd say you follow the same process: inform them, wait 1/3/7 days or whatever, then go public. If you suspect the exploit is deliberate, informing the manufacturer isn't telling them anything they didn't already know. Or, maybe it IS telling them, since in the case of open source, the exploit could have been introduced surreptitiously by a developer who's long gone, and the current developers have no idea of the exploit's existence.
Caveat: if you suspect revealing the bug will cause blowback to you. If you think the NSA/FBI/CIA will come after you for threatening to reveal it, I'd say just go public immediately, and include major press orgs so they can't just silence you.
I'm in outsourcing and our #1 problem this week by far is getting clients to actually allow us to patch their shit.
This was handled similarly to a flaw I discovered, and I think it makes sense. Facebook, for example, has about a billion users. If you have a colleague you trust at Facebook, informing that one colleague can protect Facebook's billion users.
But I didn't say "Don't tell X", I just don't want X told to the exclusion of Y. Where Y is the vendor a X is a big vulnerable company that you have connections at. If you tell X is an entirely different discussion. OpenSSL should have been near, if not at the top of, the list of groups contacted.
Also, quit bragging on protecting a billion people. It looks fancy because you're parading around a big number but you didn't protect a single one of those users when they used a vulnerable service that wasn't called facebook.
My personal view is that "responsible disclosure" is just term cooked up by lazy manufacturers.. Where was their own quality assurance and code reviews? They didint bother to do any of that in order to save few bucks more...
Its like they want headsup so they can sit on it few months, charge customers extra for fix before its public knowledge..
My personal view is, if you find bug, go public. That way fixes are done faster and as many players in field as bossible gets to know about it...
Webster was wrong, you never ever should exploit a system you don't own or are hired to pentest. If you find a security hole in a server and they don't respond, you should just go public with the exploit and most likely let someone else to hack the system for you.
- Raynet --> .
Everyone else is splitting hairs over which permutation of all possible methods is the overall best compromise, neglecting the fact that they all rather suck, but this idea actually has an advantage over the others.
As for the suggested issue with regard to everyone being too annoyed by having to take services offline for 24 hours, I'm not so sure they'd have to. If you know that the patch won't come out for another 12 hours, then the only people who will know about the bug before 12 hours from now will be any hackers who found it last year and so they've already had plenty of time to exploit you if they'd wanted to. So leaving your server online for the 12 hour period until the patches are released wouldn't be the worst idea. They either exploited you already, or they likely don't care to.
While some might argue that that's a bad idea since you now know there's an exploit, the truth is that you always knew there were exploits because there are always exploits. The only thing that's changed is that you now know that, in 12 hours, one is about to become much more well-known. So just set your alarm clock and, when the time comes, shut down your server and apply the patch.
Hopefully some people with mod points will see your comments.
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
I think there is a qualitative difference between notifying large end users like Facebook in advance, and notifying people in the distribution system for a general release. It's the former that inherently means the people who aren't large end users with privileged access get left exposed for longer than necessary, and that's what I'm objecting to.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
> OpenSSL should have been near, if not at the top of, the list of groups contacted.
Absolutely. In the case I mentioned where I found the vulnerability, the FIRST contact I made was the development team.
As to the fact that people can't be protected on every site until the updated packages are out, how does that mean they should NOT be protected when possible? Are you sad that it's "unfair" that they are protected on some sites and not others? So you'd like to remedy that by exposing their data ALL the time? Is that more fair, to have all of their data vulnerable instead?
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
In the end, the administrator organization for Webster's pension plan was fined by the Australian government for not having proper security for its data, for not properly testing its system, and for not detecting Webster's intrusions (even though the intrusions were very visible in the system logs). Criminal charges against Webster were never pursued.
Heh,keep it quiet so it can be handled in a subtle manner without making any nefarious people more aware that they already were. Then let the press disclose it well before it is fixed, so they can tell other nefarious a$$hats how to leverage it before the door is closed. Yeah, brilliance at its best. Yeah, no good answer is correct.
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
No doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
No doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange:
http://slashdot.org/comments.p...
It's only 1 of appromixately 3 or 4 he's done that to here in this exchange since he was "+5 up modded" by his own sockpuppets - go figure!
Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk
Let's let TOM speak shall we:
"I'm having great conversations on this site with one of my alias accounts" - by Tom (822) on Monday April 07, 2014 @02:29PM (#46686259) Homepage
FROM -> http://slashdot.org/comments.p...
The "BEST TOM HAS" in this exchange? Using his sockpuppets to downmod THIS POST when I posted it before in this exchange (it's only 1 of 4-5 he's done this to USING sockpuppets to upmod himself, & downmod my posts exposing him):
http://slashdot.org/comments.p...
(Tom downmods there, no doubt to effetely & vainly attempt to "hide it"... sockpuppets make downmods of your opponents easy & upmodding your regular Tom account posts up too, doesn't it? You, are lame!)
APK
P.S.=> Tom *tried* to libel me & failed after I destroyed him in a technical debate on hosts files... result?
Tom ended up "eating his words" here http://slashdot.org/comments.p... spiced with "the bitter taste of SELF-defeat" + HIS FOOT IN HIS MOUTH
... apk