Company Behind Badlock Disclosure Says Pre-Patch Hype Is Good Marketing (csoonline.com)

itwbennett writes: A new vulnerability in Windows and Samba, called Badlock, is set for disclosure on April 12, according to Badlock.org. Yes, this vulnerability has its own website and logo and therein lies the problem. In a Twitter exchange with CSO Online's Steve Ragan, Johannes Loxen, who registered the Badlock domain, called the pre-patch marketing a win-win, saying, 'A serious bug gets attention and marketing for us and our open source business is a side effect for us of course.' As Ragan notes, 'PR-driven vulnerability disclosure isn't something new,' and 'can be useful sometimes.' Marketing around Heartbleed, for example, 'generated tons of news coverage and quick reaction by administrators who worked long hours to patch vulnerable systems. There have been several since Heartbleed,' says Ragan. But in the case of Badlock, a 20-day lead time gives criminals plenty of time to tear Samba apart.

Comments

Re:Let's make some educated guesses.

[hey!]

For years I had a company whose clients were public health agencies. One time one of my customers said this to me, "You guys can do all kinds of great stuff, but the problem with you is that you want money for everything."

I was nonplussed. I just couldn't get my brain around the fact that he saw the fact that we charged for our services as somehow venal; after all this wasn't a field I went into to get rich, because that sure would have been a bust. The reason we could do things that people had only dreamed about doing as that we did something that nobody in the public sector could: hired a team of talented and qualified engineers to work on these problems. The downside of that was that those engineers don't come cheap; any time money wasn't coming in we'd be bleeding it at eye-popping rates. So we did indeed bring in a lot of money, but it all went straight out to feed the payroll dragon.

I'm glad I did my little bit for humanity, I think everyone should at some point in their career. But I probably wouldn't do it again.