Full Disclosure and Why Vendors Hate It

An anonymous reader writes "Well known iPhone hacker Jonathan Zdziarski gave a talk at O'Reilly's Ignite Boston 3 this week in which he called for the iPhone hacking community to embrace full disclosure and stop keeping secrets that were leading to the iPhone's demise. He has followed up with an article about full disclosure and why vendors hate it. He argues that vendor-only disclosure protects the vendors and not the consumer, and that vendors easily abuse this to downplay privacy concerns while continuing to sell insecure products. In contrast, he paints full disclosure as a capitalist means to keep the vendor accountable, and describes how public outcry can be one of the best motivating factors to get a vulnerability addressed."

Well of course

[eneville (745111)]

It's pretty obvious since vendors have to do more work and package another release to fix bugs. It's easier to keep this information secret and just bundle all the bug fixes into a bulk package when it suits the vendor (I expect money comes into this equation somewhere).

Re:

[peragrin (659227)]

That's only if they ever fix it to begin with. Some companies can't actually fix their software as it is broken to begin with and the security hole is what allows the software to run at all. years of software developers dealing with MSFT has set this mindset in place.

Why fix the problem when you can gloss over it with a fresh coat of paint?

note While MSFT is guilty of doing this, Third party developers are the real guilty party.

Re:Well of course

[manwal (648106)]

It's only about money. With few or no public security flaws/fixes, your company, product and brand look safe. With many, they look dangerous. It doesn't matter that security often works the other way around.

Re:

[davester666 (731373)]

It's not just about security. It's also about features. Things like the broadcast flag. Like the analog bit that accidentally got set by NBC that Microsoft implemented support for to disable recording some shows. Hell, both MS and NBC said it was a mistake that the flag was turned on. But even though there is no legal basis for even noticing that flag, Microsoft did NOT say "we'll update our software to ignore that flag".

You don't know what agreements have been made between Microsoft, Tivo, other DVR m

Re:Well of course

[Adambomb (118938)]

(I expect money comes into this equation somewhere)

Development costs for the fixes and effectively retooling costs for the production line. I would expect that making a new master and swapping it up in pressing wouldn't be the big portion of the cost, but its there.

Of course companies hate the concept of full disclosure. That would not allow them to make patch timetables based on business needs as opposed to customer needs. But then, I'll never understand why consumers accept the concept that businesses need to keep such secrecy in the name of security through obfuscation, and then smile and nod when things fall apart that "yep dealing with computers for you".

Why in the hell has this become one of the few fields where its considered normal to have a broken product? Granted its nigh impossible to have a 100% bug-free product, but the standards seem to keep falling and falling.

Re:From the article:

[by Anonymous Coward]

Women's disinterest in IT is as plain and simple as your disinterest for knitting, facials, basket weaving, romance novels and shopping. Genetic differences exist between races and sexes. Stop attempting to impose equality across things which obviously aren't. If 2000 years of history are not enough to prove that women simply have very little interest in technical fields and IT, then you are blind fool. Mind you, this is not to say that women are less competent than men in general, but rather that their competencies have been honed on different subject matters.

Re:

[Koiu Lpoi (632570)]

From the parent (emphasis mine):

...If 2000 years of history are not enough to prove that women simply have very little interest in... IT

From Wikipedia (emphasis again, mine):

Information Technology (IT), as defined by the Information Technology Association of America (ITAA), is "the study, design, development, implementation, support or management of computer-based information systems, particularly software applications and computer hardware."

I, for some reason, don't think that IT and computers have been

Re:

[masterzora (871343)]

While I agree with you about everything after and including the words "Also nevermind" and before and not including the words "I can't help...", you fail at reading comprehension. Your selective quoting so cunningly removed the very important words "technical fields", which have been around for at least 2000 years, and of which IT is a subset.

Re:

[Koiu Lpoi (632570)]

I don't fail at reading comprehension at all, buddy. He said

If 2000 years of history are not enough to prove that women simply have very little interest in technical fields and IT...

Please note the word "And" in between "technical fields" and "IT". You'll note, if you understand the meaning of the word "and", that it groups the two things together, and thus implies that IT has been around for 2000 years. The way the word "and" works, you should be able to remove either part it refers to and have the sentenc

Re:

[masterzora (871343)]

It in no way implies that IT has been around for 2000 years. You are correct in that, grammatically speaking, removing "and" and one of the joined clauses should be correct. I repeat, grammatically speaking. It doesn't have to retain its meaning or truth value, however. The sentence "The human race is composed entirely of men and women" is true (okay, there are a few percent, but ignore that for sake of a simple example). However, neither "The human race is composed entirely of men" nor "The human race

Re:

[Koiu Lpoi (632570)]

In that case, "men and women" is a single article. If we use that interpretation, it still makes no sense, as "IT" and "technical fields" are one article, and them, together, have not been around for 2000 years.

Re:

[jeremymiles (725644)]

What makes you say that genetic differences exist between races? Although I'll agree that there are differences between sexes, there's little agreement on what even defines a race, never mind whether there's a difference. There is massively more genetic variation in people whose ancestry is African than the differences between all the other 'races' combined.

Re:

[jc42 (318812)]

What makes you say that genetic differences exist between races? Although I'll agree that there are differences between sexes, there's little agreement on what even defines a race, ...

One of my favorite explanations of the bogosity of the concept of race is that here in the US, lists of races usually include "Hispanic". You don't need to know much (if anything) about genetics to understand that there can't be any genetic basis to any such "race".

The other main counterexample in the US is that most "African

Re:

[jeremymiles (725644)]

The Hispanic thing irritates me - I design and analyze goverment surveys, and we have to ask first, if people are Hispanic/Latino, or not, and then we ask their race: White, Black, Asian, Pacific Islander, Native American, etc. I kind of feel we should let them say that they aren't white, they are Hispanic, if they want to. Even if it's wrong.
The people who are Hispanic always tick 'other' under race, because they don't consider themselves white. Then when we write the report we have to talk about Whit

Re:

[FishWithAHammer (957772)]

Mods: you done got trolled, idiots. That line does not exist in the article.

Tip: If the fucktarded anonymous coward CAN'T SPELL, that's generally a good indication.

Re:From the article:

[FishWithAHammer (957772)]

Is it Wednesday? I have it on good authority that Wednesday is Rob's turn to enact trollan gaemz.

Re:

[FishWithAHammer (957772)]

Yes, I am.

Re:From the article:

[Koiu Lpoi (632570)]

I totally agree. Since EEE PCs and iPhones are now small enough to fit in the kitchen, we may be seeing a change in this trend.

Incredibly Inflated Sense of Self Worth

[NDPTAL85 (260093)]

This guy really thinks highly of himself. He claims the iPhone's "secrecy" or Apple's inattention to the "privacy flaws" have hurt the product.

Ridiculous.

The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.

I've never seen someone anywhere complain that its insecure and vulnerable to hackers.

Re:

[JustNilt (984644)]

The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.

This is somewhat true. The average consumer simply isn't aware of the security issues with most things they use. It doesn't matter whether it's their phone, their computer or their front door locks. This is actually kind of the guy's point. Companies are able to keep people in the dark at will, generally.

I've never seen someone anywhere complain that its insecure and vulnerable to hackers.

That's funny. Here's a link to a Forbes article from last summer regarding a lack of security.
http://tinyurl.com/2huxru [tinyurl.com]

Here's another link regarding an actual exploit vector, reported by the N

Re:

[samkass (174571)]

What's interesting is most people that actually own an iPhone don't seem to give a rat's ass about security on it.

Exactly. Which proves this article's premise completely wrong. The only people who ARE interested are the malicious folks, which will be almost your entire "full disclosure" audience. Full disclosure is a great way to give the malicious folks a head start, and won't do one tiny little thing towards linking a product's popularity to its security.

Re:Incredibly Inflated Sense of Self Worth

[RAMMS+EIN (578166)]

``Which proves this article's premise completely wrong. The only people who ARE interested are the malicious folks, which will be almost your entire "full disclosure" audience. Full disclosure is a great way to give the malicious folks a head start, and won't do one tiny little thing towards linking a product's popularity to its security.''

I am offended by your comment. I am in favor of full disclosure, and I am not a black hat. I know there are many people like me.

Also, your analysis is wrong on both counts. Full disclosure doesn't give anyone a head start. On the contrary, it informs everybody of the flaw at the same time. That does indeed include the black hats, but also the vendor and the users. This allows the black hats to develop exploits, but it also allows the vendor to work on a fix, and the users to implement temporary stopgaps. The alternative is, pretty much, not informing the users of the flaw - thereby leaving them unaware that a vulnerability has been discovered. As for the black hats: they work hard to find security flaws and avoid full disclosure - after all, as long as only they know the flaw exists, they can exploit it for fun and profit.

With regard to linking a product's popularity to its security: I know of two things that will do that. The first is users feeling victimized by the bad security of the product they have. The other is making actual and potential users aware of the security risks of a product. Full discloruse brings the insecurity of a product out in the open, which is a step towards the latter and can also help with the former. Of course, the effect is going to be rather limited as long as users don't care very much, but I can tell you that the effect is there.

Re:

[Kjella (173770)]

This allows the black hats to develop exploits, but it also allows the vendor to work on a fix, and the users to implement temporary stopgaps. The alternative is, pretty much, not informing the users of the flaw - thereby leaving them unaware that a vulnerability has been discovered. As for the black hats: they work hard to find security flaws and avoid full disclosure - after all, as long as only they know the flaw exists, they can exploit it for fun and profit.

To take the last sentence first, I don't see your point as obiviously black hats would not disclose anything to anybody, the question would be if black hats prefer white hats to do vendor disclosure or full disclosure then do the opposite. The question is, how often can users do any meaningful stopgaps? Let's say for example there's a spoofing bug in Firefox (or IE) and a parsing bug in OpenOffice (or MS Office), and there's no meaningful fix except "don't use the product". Well, people aren't going to sto

Re:

[samkass (174571)]

I am offended by your comment. I am in favor of full disclosure, and I am not a black hat. I know there are many people like me.

You need to grow a thicker skin. I'm sorry you're offended but any reasonable person should realize my comment was not a personal attack, but an observation about the tendencies of the market. Unless you consider yourself as an individual an entire "market segment", my point that full disclosure will do nothing to tie product popularity to security stands. As does the assertion

Re:

[quanticle (843097)]

The black hats and script kiddies can always move faster than the vendors.

Nonsense. For closed source products, there's no reason that the manufacturer shouldn't be able to move faster than the black-hat. After all, doesn't the manufacturer have access to the source code, while the black hat has to work at reverse engineering?

Re:

[Graymalkin (13732)]

A black hat hacker doesn't need to do any QA testing of their exploit. If it doesn't work 50% of the time it is still considered a successful exploit. If a vendor's patch breaks something on customer machines even 10% of the time they'll get as much if not more flack than if they had waited to patch an exploit. This is worse if their fix is only half-ass in order to get it out in the wild and it only works against one particular exploit and doesn't fix that class of exploit. Embargo dates on exploits found

Re:

[NDPTAL85 (260093)]

His point is wrong though. Its usually not the companies that keep people in the dark but the peoples own lack of care.

I'm not saying iPhone exploits don't exist I'm just saying they're not a big deal. For an exploit finder every exploit is a big deal. The thing is most people don't spend their days trying to crack their phones. And every device has exploits. Blackberries, Windows Mobile, Symbian, Palm OS, Linux based phones....etc. No device is immune.

Ease of use trumps security. Windows XP should prove th

Re:

[TheRaven64 (641858)]

I very much doubt anyone on Slashdot is stupid enough to click on tinyurl links. Perhaps you should consider learning how to make links [w3.org].

Re:

[thegnu (557446)]

This guy really thinks highly of himself. He claims the iPhone's "secrecy" or Apple's inattention to the "privacy flaws" have hurt the product.

Ridiculous.

The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.

So you're saying that since the biggest problems aren't the closed platform and security issues, that they haven't hurt the product. Good use of the argument "A is true, therefore R"

And anyway, about cut and paste, if the platform weren't locked down (going off-topic a bit), there would've been a third party cut and paste app within a couple weeks of release for $10. Within a couple months, there would've been 20 free options.

Not the biggest problem with the iPhone, but do we need to approach problems in

Peaks

[Gracenotes (1001843)]

One of Apple's greatest marketing strengths is this ability to add hype around their products by peaking the curiosity of the common geek.

As an aforementioned common geek, the misspelling in this sentence is enough to put me in a peak!

Re:

[Mordok-DestroyerOfWo (1000167)]

That's the funniest post I've read in a week, as I write this on my desk made of teak

Re:

[Dun Malg (230075)]

That's the funniest post I've read in a week, as I write this on my desk made of teak

Isn't that spelled "tique"?

yeah, I think the joke is probably dead...

Re:

[thegnu (557446)]

That's the funniest post I've read in a week, as I write this on my desk made of teak

Isn't that spelled "tique"?

yeah, I think the joke is probably dead...

It's only dead in your hea...no, no...you're right.

That's why we have embargo dates

[unixan (800014)]

I work for a vendor and so I get to see the view from the inside out on this.

Most times, when a vulnerability is discovered by a professional security group or an upstream vendor, they both tell us what it is, and propose an "embargo" date for when they plan to make it public.

This gives vendors time to react properly but still serves the public with disclosure.

Re:That's why we have embargo dates

[Zoop (59907)]

As someone who manages an open source product, I get notified (despite ample ways for the "researchers" to contact me) because I have Google alerts for our product's name. I have never, not once, been contacted by the discoverer of a vulnerability or the security groups who publicize exploits.

This has left me with a very dim view of the security community, and I sincerely doubt the earnestness of the discoverers. They act more like script kiddies out to tag something with their graffiti rather than someone concerned about the consumer.

Maybe for Apple there are more concerned people out there, but I don't have Apple's resources and would appreciate a couple of weeks to get a fix in and tested before you expose my users to more black hats (as opposed to the black hats who knew about it before).

I WANT TO KNOW. I WANT TO FIX IT. But the experience I've had so far is that I care more about my users than the security companies and script kiddies masquerading as "researchers" do.

Re:

[TheRaven64 (641858)]

You don't actually need full disclosure for this. You can simply publicly disclose that you have found one arbitrary code execution vulnerability in product X. Either the vendor confirms it and specifies a date when they will release a fix, or you disclose the nature of the vulnerability publicly.

everyone hates full disclosure

[fermion (181285)]

Cyptogram has a discussion of this issue in relation to the oft used argument that only people who have are committing crimes should be afraid of full disclosure. The issue in the note, iirc, related to data mining and video surveillance. The counter example to the statement was the police apparent unwillingness to give tapes of traffic stops, for example, to those private parties involved. It seems that the tapes are there to protect the cops, which is good, but no one is willing to protect the citizen. We see this even in the taping of the very occasional police overreaction.

Almost no one is comfortable with full disclosure, and the ultimate arrogance and hypocrisy is demanding it in other, while fabricating excuses why your yourself cannot comply. We see this in the current US presidential campaign, where it is typical to release tax returns, but some people feel too above everyone else to so do. This includes other cases where persons who are, like the police, are paid by the american taxpayer, but refuse to fully account for their work hours to the american tax payer. the examples, private and public, are endless.

So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one. It sounds trite, and everyone always complains about the philosophy, but it works. MS is a target for viruses, even if it not inherently less secure, so I don't use it on a regular basis. SUVs are less secure as they are not inherently stuck to the ground through the tire patches, and require computer intervention to keep them for tipping over, so I don't buy them. I don't shop at stores with affinity cards. If an iPhone is an attack against security, buy something else.

Back to the issue of security, there is one serious misconception that I believe many people make. Just because one does not publish ones security details on the internet does not mean that one is practicing security by obscurity. Just because I do not publish my path to work on the net, and my schedule, and the times and places that my stuff is most venerable to theft, does not mean I practice security by obscurity or have a ideological hate of full disclosure. And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable. If the vendor does nothing about it in a fairly short time frame, then the equation shifts.

Which is why the most secure system may be open source. If something is discovered, then an slightly above average user may be able to fix it, and no one has to wait on the vendor. But open source solutions do not seem to have traction in the marketplace, so we are where we are.

Re:

[Hope Thelps (322083)]

So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one. It sounds trite, and everyone always complains about the philosophy, but it works.

1. Without full disclosure, your options for determining whether there are security risks preventing you from buying one are more limited than they would otherwise be.

2. If you mean "don't buy one if you think lack of full disclosure is itself a problem" then that seems equivalent to demanding full disclosure.

Re:

[Kjella (173770)]

1. Without full disclosure, your options for determining whether there are security risks preventing you from buying one are more limited than they would otherwise be.

To some degree, on the other hand disclosure notices can have their own spin. Actually exploited vunerabilities in the wild aren't such a bad metric, and they're much harder to hide... Just to throw one monkey wrench out there, say debian experimental is more like a development snapshot than anything else. Is it fair to count one exploit made, discovered and fixed there the same as one exploit in Windows? Or would it be fairer to compare debian stable to windows? In the end, it's not going to be perfect no matter how you do the math.

Re:

[risinganger (586395)]

So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one.

Without disclosure how will you know if there are significant security issues? The author wants disclosure so consumers can say "hey, your product is insecure I'm taking my money elsewhere".

And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable. If the vendor does nothing about it in a fairly short time frame, then the equation shifts.

Why shouldn't the consumer be allowed the choice of continuing to use (or not) an insecure product while waiting for a patch? Take the recent Flash vulnerability. I'd much rather know straight away to not leave myself at risk while they work on a patch than to discover it after my machine has been compromised. Without

Re:

[TubeSteak (669689)]

And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable.

TFA is not saying that "giving a vendor time to fix an issue" is unreasonable, merely that it does not produce the best results for everyone.

Which is why the most secure system may be open source. If something is discovered, then an slightly above average user may be able to fix it, and no one has to wait on the vendor.

OSS is not more secure because some "above average user" can fix it, it is supposedly more secure because many people have vetted it.

Even that has shown to be the exception and not the rule.
Decade old bugs pop up in all kinds of 'mature' OSS software

Security is a moving target.

Re:

[legirons (809082)]

TFA is not saying that "giving a vendor time to fix an issue" is unreasonable

The vendor had plenty of time to fix the issue when they wrote the software

And again when they tested it.

And again when they did their pre-release security audit of the software

So why, after the software has been released and widely-installed for years, is it necessary to start another arbitrary clock for them to make it secure? Their patch is already overdue by time()-releasedate, and they need to explain their previous installat

Full Disclosure - but responsibly

[Animaether (411575)]

Full Disclosure is great - but inform the vendor first.. if they don't take any action in, say, 3 days (I've used that number before - I'm sticking with it) to alleviate it, then hit the internets with it.

But too often these types are calling for Full Disclosure - immediately! Don't even bother to inform the vendor! RAR! Cry havoc, and let loose the scriptkiddies!

"The bad guy is already going to test and exploit these vulnerabilities long before the public even discovers them - the good guys ought to have a crack at verifying it too."
That is an assumption. The assumption that bad guys know about the vulnerability -before- the 'public discoverer' went with full disclosure. Plus the assumption that the bad guys' work would be as bad, or worse than, what script kiddies would do in the time between your discovery and your disclosure. I don't think those are assumption that can be made, based on - admittedly anecdotal - evidence (crashing mIRC 6.something users' IRC application on large IRC networks using a malformed DCC command only became a problem once it was disclosed and everybody and their dog started doing it, while the developer was already in the process of fixing.)

There's a middle ground - I put it at 3 days. Where do you put it, Jonathan Zdziarski? Your article seems to indicate "0 day", but I can't imagine you being that irresponsible.

Re:

[Cal Paterson (881180)]

This is a pointless line-in-the-sand to draw.

When a malicious party finds out about a hole, there is no 3 day grace. Vendors want to treat security in a casual manner, and that is truly irresponsible.

There is no good reason to put anyone above the public.

Re:

[SoupIsGoodFood_42 (521389)]

I'd rather they took their time over 3 days and fix it properly than break functionality or introduce another security issue because of a mad rush. I'm just trying to be realistic.

Flaw in capitalism, not industry

[plasticsquirrel (637166)]

The issue that he raises is a flaw in capitalism, not specific to this case. Capitalism assumes that consumers have accurate information about their purchases. Making this information readily available is not encouraging capitalism, but rather trying to deny that the flaw exists.

If anything, this has the trappings of libertarian or democratic socialism. The idea of democracy taking a role in putting moral standards on powerful economic institutions, is not traditionally capitalist.

Re:

[Cal Paterson (881180)]

Capitalism doesn't assume anything. It's the one economic system that does the right thing no matter how many people fuck up.

Neither is really concerned with consumers

[crmarvin42 (652893)]

When it comes to vulnerabilities, the vendors only care in so far as it causes a PR problem for them. However, I don't believe that these "Security Experts" are crusading for consumers either. They tell the company that there is a problem, but if the company doesn't decided that the flaw "They" found is the most important thing then the "Security Expert" throws a hissy fit and tells everyone about it in revenge. The "Security Expert" appears to me to be hoping someone will develop some malware that utili

False dichotomy.

[argent (18001)]

Vendor first doesn't mean "vendor only", and nobody says you need to sit on a flaw forever if the vendor doesn't fix it. You're giving them advance notice, not carte blanche.

Re:

[E IS mC(Square) (721736)]

You read the article but not the summary? WTF???