Company Behind Badlock Disclosure Says Pre-Patch Hype Is Good Marketing (csoonline.com)

itwbennett writes: A new vulnerability in Windows and Samba, called Badlock, is set for disclosure on April 12, according to Badlock.org. Yes, this vulnerability has its own website and logo and therein lies the problem. In a Twitter exchange with CSO Online's Steve Ragan, Johannes Loxen, who registered the Badlock domain, called the pre-patch marketing a win-win, saying, 'A serious bug gets attention and marketing for us and our open source business is a side effect for us of course.' As Ragan notes, 'PR-driven vulnerability disclosure isn't something new,' and 'can be useful sometimes.' Marketing around Heartbleed, for example, 'generated tons of news coverage and quick reaction by administrators who worked long hours to patch vulnerable systems. There have been several since Heartbleed,' says Ragan. But in the case of Badlock, a 20-day lead time gives criminals plenty of time to tear Samba apart.

Comments

Let's make some educated guesses.

[Anonymous Coward]

Let's make some educated guesses about this problem.

1. It is a protocol-related bug, since it affects two different implementations.

2. It involves file locking, hence the name.

3. There might very well be some ruthless self-promotion going on here.

Re:Let's make some educated guesses.

[phayes]

Tridge has very publicly stated that the hard part in making Samba work was not in following Microsoft's specifications but identifying and replicating the bugs in Microsoft's implementations.

Re:Let's make some educated guesses.

[Anonymous Coward]

> 1. It is a protocol-related bug, since it affects two different implementations.

Ha. As if there was any separation of protocol and implementation at Microsoft.

Re:Let's make some educated guesses.

[hey!]

For years I had a company whose clients were public health agencies. One time one of my customers said this to me, "You guys can do all kinds of great stuff, but the problem with you is that you want money for everything."

I was nonplussed. I just couldn't get my brain around the fact that he saw the fact that we charged for our services as somehow venal; after all this wasn't a field I went into to get rich, because that sure would have been a bust. The reason we could do things that people had only dreamed about doing as that we did something that nobody in the public sector could: hired a team of talented and qualified engineers to work on these problems. The downside of that was that those engineers don't come cheap; any time money wasn't coming in we'd be bleeding it at eye-popping rates. So we did indeed bring in a lot of money, but it all went straight out to feed the payroll dragon.

I'm glad I did my little bit for humanity, I think everyone should at some point in their career. But I probably wouldn't do it again.

Re:Let's make some educated guesses.

[mwvdlee]

Trickle down economics:
Small government, because otherwise a lot of money is wasted on people who are not me.
Big corporate, because otherwise a lot of money is wasted on people who are not me.

Re:Let's make some educated guesses.

[KGIII]

any time money wasn't coming in we'd be bleeding it at eye-popping rates

This is very, very astute and true. It's one of the things to note if you're going to hang out your shingle and expect to employ people. They expect to be paid - even if there's no money coming in and making payroll is important. Which, if you're curious, is how I ended up having to learn to do all the various tasks that needed doing. There was a point in time where I even helped to keep the place clean - emptying trash, sweeping and mopping, and even coming in on weekends to clean everything from workstations to windows. (At the time, only a few of the workstations had Windows! They were mostly SunStations as I recall.) Of course, that's not really the type of windows I meant.

There were a lot of 16 hour days because hiring more people wasn't in the cards at the time. Yes, I could have afforded them for the time being. But could I have kept them both employed and stimulated during a lull? I could have pretended and just hired and laid off but I'm sure the reputation would have gotten around and I'm just not that kind of person.

Re:Let's make some educated guesses.

[smooth wombat]

Trickle down hasn't worked in over 30 years. Just ask Kansas how well it's working for them. Yet somehow "conservatives" think this works.

You cannot make people more people successful if you attack the people who make them successful.

You cannot make more people richer by only giving them crumbs.

I'm not a socialist. I'm one of the dying breed of real conservatives. However, when I hear multi-billion dollar companies whine they can't pay their people more yet have no problem giving out multi-million dollar bonuses to people already making a million or more a year AND have billions socked away overseas AND go to the taxpayer for either bailouts or tax breaks or have them build something, it's disingenuous at best and arrogant at worst for them to claim how horrible things are.

We always hear why certain people are paid huge salaries, because the companies want the best, yet by their actions these same companies are showing they don't want the best people working for them in other capacities because they're not willing to pay them.

If trickle down had ever worked the salaries of people wouldn't still be the same, adjusted for inflation, as they were 20+ years ago.

Bad for everyone

[jofas]

Vulnerabilities aren't profitable. The cockroaches who make money from their fallout might see it that way because that how racketeers think, but vulns hurt business overall. And that's setting aside potentially ruined lives because of identity theft etc. The heartbleed marketing fiasco brought out of the woodwork low-lives who made fake "test your system for heartbleed" pages. This is not a good thing.

Re:Good for everyone

[ole_timer]

Vulns are most assuredly profitable or there wouldn't be anyone looking for them.

Re:SMB File Shares?

[omnichad]

SMB==CIFS

It's the only decent option for WindowsLinux file sharing. My home server runs Samba as well as Netatalk, because NFS doesn't work as well as it should with OS X either.

Re: Quoted line about lead time is stupid

[jofas]

TFA mentions (if you read it) that a samba dev is the one releasing the bug.

Re:Win Win For The Attention Whores

[omnichad]

There are a lot of embedded implementations of Samba, meaning a lot of firmware patches going out right after this. That includes hundreds of models of routers and NAS units.

Re:Quoted line about lead time is stupid

[omnichad]

I would imagine that Windows 7 and 8 will not get patched at all (and certainly not XP or Vista)

XP won't get a patch because it's not supported (unless this affects interoperability between patched and unpatched - then they might be motivated).

But this is a security update. Vista is supported until next April. They're going to have a very hard time convincing the public that they shouldn't patch that. And Windows 7 is far more under the umbrella than Vista.

Heartbleed got a patch for XP despite it being out of support entirely.

Re:SMB File Shares?

[Aaden42]

Out of curiousity, what troubles have you had with an OSX NFS client to a Linux server? I use the automountd approach (access /net/SERVERNAME/SHARENAME), and it’s pretty good. It does get stupid if the NFS server goes away for any reason. Usually have to restart the Mac before things are normal again if the server reboots or any of the NFS/sunrpc daemons crash. And of course I still need Netatalk for TimeMachine.

Other than that, I find NFS is faster than Netatalk by a goodly bit. I have been meaning to try a good benchmark of CIFS, NFS, and Netatalk with 10.11 as the special sauce for CIFS is supposedly even more special now...

Could be important, might not be...

[Junta]

We shall see when the details are released, but in the wake of Heartbleed, I've grown desensitized to marketing treatment for vulnerabilities. Security people jump up and down and are frequently justified, but sometimes are just stating the obvious and/or something of low practical risk. The problem being in general security folks tend not to weight their 'discoveries', so it's hard to know if this time the sky really is falling (sometimes it really is) or they just didn't like some subtle design decision that actually isn't really invalid, just not how they would have done something.

If they really wanted to be useful

[jlv]

They'd release the details on the bug 20 days *after* the patches had been released. Saying that they'll release the details on April 12 on the same day patches will be available is bogus. The fact that they made not just a catchy name but also a logo leads me to agree they are attention whores.