Full Disclosure and Why Vendors Hate It 91
An anonymous reader writes "Well known iPhone hacker Jonathan Zdziarski gave a talk at O'Reilly's Ignite Boston 3 this week in which he called for the iPhone hacking community to embrace full disclosure and stop keeping secrets that were leading to the iPhone's demise. He has followed up with an article about full disclosure and why vendors hate it. He argues that vendor-only disclosure protects the vendors and not the consumer, and that vendors easily abuse this to downplay privacy concerns while continuing to sell insecure products. In contrast, he paints full disclosure as a capitalist means to keep the vendor accountable, and describes how public outcry can be one of the best motivating factors to get a vulnerability addressed."
Well of course (Score:4, Insightful)
Re:From the article: (Score:4, Insightful)
Re: (Score:1, Insightful)
Now I don't disagree that the excerpt mentioned by the grandparent post sounds somewhat inappropriate, but if he deserves insightful points, more so does the parent - prejudice should never be fought with reverse prejudice.
Re: (Score:2)
From Wikipedia (emphasis again, mine):
I, for some reason, don't think that IT and computers have been
Re: (Score:2)
Re: (Score:2)
Please note the word "And" in between "technical fields" and "IT". You'll note, if you understand the meaning of the word "and", that it groups the two things together, and thus implies that IT has been around for 2000 years. The way the word "and" works, you should be able to remove either part it refers to and have the sentenc
Re: (Score:2)
It in no way implies that IT has been around for 2000 years. You are correct in that, grammatically speaking, removing "and" and one of the joined clauses should be correct. I repeat, grammatically speaking. It doesn't have to retain its meaning or truth value, however. The sentence "The human race is composed entirely of men and women" is true (okay, there are a few percent, but ignore that for sake of a simple example). However, neither "The human race is composed entirely of men" nor "The human race
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Example, at the college I attended, the engineering school had a male:female ratio of something like 8:1, whereas the nursing school was closer to 1:5. I can say from watching the school very, very closely after hearing the whole "women are driven away from tech" speech that the female students we did get were far more likely to actually graduate, and seemed to be generally treated like one of the guys
Stereotypes are FUN! (Score:2)
"because male techs tend to have limited interests and are difficult to work with when you're female"
In MY experience, women in IT WANT to be treated differently. They think ovaries make them special. I guess personal experience can vary, huh? Let's not even get into the abuses of playing the "sexual harrassment" card...
"It's the atmosphere."
In MY experience, it really IS the atmosphere. If some of the women I've worked w
Re: (Score:2)
Re: (Score:3, Informative)
One of my favorite explanations of the bogosity of the concept of race is that here in the US, lists of races usually include "Hispanic". You don't need to know much (if anything) about genetics to understand that there can't be any genetic basis to any such "race".
The other main counterexample in the US is that most "African
Re: (Score:2)
The people who are Hispanic always tick 'other' under race, because they don't consider themselves white. Then when we write the report we have to talk about Whit
Re: (Score:3, Informative)
Tip: If the fucktarded anonymous coward CAN'T SPELL, that's generally a good indication.
Re:From the article: (Score:4, Funny)
Re: (Score:2)
Re: (Score:1, Offtopic)
Admitting that it's a generalization, and there are many exceptions, he's right. Women in IT are every bit as good as the guys. But when you get into the world most of us inhabit, where all you know is what you've picked up on your own or from a couple of buddies in the field, men rule.
I challenge anybody to find among their non-geek friends and relatives an equal number of women who are willing to swap a video card or install an extra drive, or do minor OS mods. Perfect example: A friend of mine's fa
Re: (Score:2, Insightful)
It's not a matter of whether or not group A or B is better at field C, but rather whether more people of equal value come from group A or B into field C.
Re:From the article: (Score:5, Funny)
Re: (Score:1)
Re: (Score:3, Funny)
Why fix the problem when you can gloss over it with a fresh coat of paint?
note While MSFT is guilty of doing this, Third party developers are the real guilty party.
Re:Well of course (Score:5, Insightful)
Re: (Score:3, Interesting)
You don't know what agreements have been made between Microsoft, Tivo, other DVR m
Re:Well of course (Score:4, Interesting)
Of course companies hate the concept of full disclosure. That would not allow them to make patch timetables based on business needs as opposed to customer needs. But then, I'll never understand why consumers accept the concept that businesses need to keep such secrecy in the name of security through obfuscation, and then smile and nod when things fall apart that "yep dealing with computers for you".
Why in the hell has this become one of the few fields where its considered normal to have a broken product? Granted its nigh impossible to have a 100% bug-free product, but the standards seem to keep falling and falling.
Incredibly Inflated Sense of Self Worth (Score:5, Insightful)
Ridiculous.
The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.
I've never seen someone anywhere complain that its insecure and vulnerable to hackers.
Re: (Score:3, Informative)
The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.
This is somewhat true. The average consumer simply isn't aware of the security issues with most things they use. It doesn't matter whether it's their phone, their computer or their front door locks. This is actually kind of the guy's point. Companies are able to keep people in the dark at will, generally.
I've never seen someone anywhere complain that its insecure and vulnerable to hackers.
That's funny. Here's a link to a Forbes article from last summer regarding a lack of security.
http://tinyurl.com/2huxru [tinyurl.com]
Here's another link regarding an actual exploit vector, reported by the N
Re: (Score:2)
Exactly. Which proves this article's premise completely wrong. The only people who ARE interested are the malicious folks, which will be almost your entire "full disclosure" audience. Full disclosure is a great way to give the malicious folks a head start, and won't do one tiny little thing towards linking a product's popularity to its security.
Re:Incredibly Inflated Sense of Self Worth (Score:5, Insightful)
I am offended by your comment. I am in favor of full disclosure, and I am not a black hat. I know there are many people like me.
Also, your analysis is wrong on both counts. Full disclosure doesn't give anyone a head start. On the contrary, it informs everybody of the flaw at the same time. That does indeed include the black hats, but also the vendor and the users. This allows the black hats to develop exploits, but it also allows the vendor to work on a fix, and the users to implement temporary stopgaps. The alternative is, pretty much, not informing the users of the flaw - thereby leaving them unaware that a vulnerability has been discovered. As for the black hats: they work hard to find security flaws and avoid full disclosure - after all, as long as only they know the flaw exists, they can exploit it for fun and profit.
With regard to linking a product's popularity to its security: I know of two things that will do that. The first is users feeling victimized by the bad security of the product they have. The other is making actual and potential users aware of the security risks of a product. Full discloruse brings the insecurity of a product out in the open, which is a step towards the latter and can also help with the former. Of course, the effect is going to be rather limited as long as users don't care very much, but I can tell you that the effect is there.
Re: (Score:1)
On the contrary, it informs everybody of the flaw at the same time. That does indeed include the black hats, but also the vendor and the users.
I have to agree, for the same reason I'd rather know if a product I buy might set my house on fire. Or, perhaps a better analogy, if the product might allow someone else to set my house on fire.
Knowing a product has a security flaw might prevent me from purchasing it, yes, but only if there isn't a reliable way to prevent the flaw from being exploited until the vendor can release a patch.
Re: (Score:3, Insightful)
This allows the black hats to develop exploits, but it also allows the vendor to work on a fix, and the users to implement temporary stopgaps. The alternative is, pretty much, not informing the users of the flaw - thereby leaving them unaware that a vulnerability has been discovered. As for the black hats: they work hard to find security flaws and avoid full disclosure - after all, as long as only they know the flaw exists, they can exploit it for fun and profit.
To take the last sentence first, I don't see your point as obiviously black hats would not disclose anything to anybody, the question would be if black hats prefer white hats to do vendor disclosure or full disclosure then do the opposite. The question is, how often can users do any meaningful stopgaps? Let's say for example there's a spoofing bug in Firefox (or IE) and a parsing bug in OpenOffice (or MS Office), and there's no meaningful fix except "don't use the product". Well, people aren't going to sto
Re: (Score:3, Insightful)
Re: (Score:2)
Nonsense. For closed source products, there's no reason that the manufacturer shouldn't be able to move faster than the black-hat. After all, doesn't the manufacturer have access to the source code, while the black hat has to work at reverse engineering?
Re: (Score:2)
You need to grow a thicker skin. I'm sorry you're offended but any reasonable person should realize my comment was not a personal attack, but an observation about the tendencies of the market. Unless you consider yourself as an individual an entire "market segment", my point that full disclosure will do nothing to tie product popularity to security stands. As does the assertion
Re: (Score:2)
I'm not saying iPhone exploits don't exist I'm just saying they're not a big deal. For an exploit finder every exploit is a big deal. The thing is most people don't spend their days trying to crack their phones. And every device has exploits. Blackberries, Windows Mobile, Symbian, Palm OS, Linux based phones....etc. No device is immune.
Ease of use trumps security. Windows XP should prove th
Re: (Score:2)
Re: (Score:2)
This guy really thinks highly of himself. He claims the iPhone's "secrecy" or Apple's inattention to the "privacy flaws" have hurt the product.
Ridiculous.
The biggest complaints about the iPhone are the lack of 3G, lack of GPS and no current support for cut and paste or MMS.
So you're saying that since the biggest problems aren't the closed platform and security issues, that they haven't hurt the product. Good use of the argument "A is true, therefore R"
And anyway, about cut and paste, if the platform weren't locked down (going off-topic a bit), there would've been a third party cut and paste app within a couple weeks of release for $10. Within a couple months, there would've been 20 free options.
Not the biggest problem with the iPhone, but do we need to approach problems in
Re: (Score:1)
If I took investment advice from hackers, I would be one broke Piggy.
Peaks (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
yeah, I think the joke is probably dead...
Re: (Score:2)
yeah, I think the joke is probably dead...
That's why we have embargo dates (Score:4, Informative)
Most times, when a vulnerability is discovered by a professional security group or an upstream vendor, they both tell us what it is, and propose an "embargo" date for when they plan to make it public.
This gives vendors time to react properly but still serves the public with disclosure.
As a consumer, I want to know earlier (Score:1, Insightful)
Re: (Score:2)
Re:That's why we have embargo dates (Score:5, Interesting)
This has left me with a very dim view of the security community, and I sincerely doubt the earnestness of the discoverers. They act more like script kiddies out to tag something with their graffiti rather than someone concerned about the consumer.
Maybe for Apple there are more concerned people out there, but I don't have Apple's resources and would appreciate a couple of weeks to get a fix in and tested before you expose my users to more black hats (as opposed to the black hats who knew about it before).
I WANT TO KNOW. I WANT TO FIX IT. But the experience I've had so far is that I care more about my users than the security companies and script kiddies masquerading as "researchers" do.
Re: (Score:1)
everyone hates full disclosure (Score:5, Insightful)
Almost no one is comfortable with full disclosure, and the ultimate arrogance and hypocrisy is demanding it in other, while fabricating excuses why your yourself cannot comply. We see this in the current US presidential campaign, where it is typical to release tax returns, but some people feel too above everyone else to so do. This includes other cases where persons who are, like the police, are paid by the american taxpayer, but refuse to fully account for their work hours to the american tax payer. the examples, private and public, are endless.
So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one. It sounds trite, and everyone always complains about the philosophy, but it works. MS is a target for viruses, even if it not inherently less secure, so I don't use it on a regular basis. SUVs are less secure as they are not inherently stuck to the ground through the tire patches, and require computer intervention to keep them for tipping over, so I don't buy them. I don't shop at stores with affinity cards. If an iPhone is an attack against security, buy something else.
Back to the issue of security, there is one serious misconception that I believe many people make. Just because one does not publish ones security details on the internet does not mean that one is practicing security by obscurity. Just because I do not publish my path to work on the net, and my schedule, and the times and places that my stuff is most venerable to theft, does not mean I practice security by obscurity or have a ideological hate of full disclosure. And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable. If the vendor does nothing about it in a fairly short time frame, then the equation shifts.
Which is why the most secure system may be open source. If something is discovered, then an slightly above average user may be able to fix it, and no one has to wait on the vendor. But open source solutions do not seem to have traction in the marketplace, so we are where we are.
Re: (Score:3)
So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one. It sounds trite, and everyone always complains about the philosophy, but it works.
1. Without full disclosure, your options for determining whether there are security risks preventing you from buying one are more limited than they would otherwise be.
2. If you mean "don't buy one if you think lack of full disclosure is itself a problem" then that seems equivalent to demanding full disclosure.
Re: (Score:2)
1. Without full disclosure, your options for determining whether there are security risks preventing you from buying one are more limited than they would otherwise be.
To some degree, on the other hand disclosure notices can have their own spin. Actually exploited vunerabilities in the wild aren't such a bad metric, and they're much harder to hide... Just to throw one monkey wrench out there, say debian experimental is more like a development snapshot than anything else. Is it fair to count one exploit made, discovered and fixed there the same as one exploit in Windows? Or would it be fairer to compare debian stable to windows? In the end, it's not going to be perfect no matter how you do the math.
Re: (Score:2, Insightful)
So why would geeks, even those that never put on a tinfoil hat, demand full disclosure, especially in a market place where we have the option to simply not spend the money. In this case, if there are significant security issues with the iphone, don't buy one.
Without disclosure how will you know if there are significant security issues? The author wants disclosure so consumers can say "hey, your product is insecure I'm taking my money elsewhere".
And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable. If the vendor does nothing about it in a fairly short time frame, then the equation shifts.
Why shouldn't the consumer be allowed the choice of continuing to use (or not) an insecure product while waiting for a patch? Take the recent Flash vulnerability. I'd much rather know straight away to not leave myself at risk while they work on a patch than to discover it after my machine has been compromised. Without
Re: (Score:2)
And giving a vendor time to fix an issue, even if everyone except the average consumer knows about it, is not unreasonable.
TFA is not saying that "giving a vendor time to fix an issue" is unreasonable, merely that it does not produce the best results for everyone.
Which is why the most secure system may be open source. If something is discovered, then an slightly above average user may be able to fix it, and no one has to wait on the vendor.
OSS is not more secure because some "above average user" can fix it, it is supposedly more secure because many people have vetted it.
Even that has shown to be the exception and not the rule.
Decade old bugs pop up in all kinds of 'mature' OSS software
Security is a moving target.
Re: (Score:2)
The vendor had plenty of time to fix the issue when they wrote the software
And again when they tested it.
And again when they did their pre-release security audit of the software
So why, after the software has been released and widely-installed for years, is it necessary to start another arbitrary clock for them to make it secure? Their patch is already overdue by time()-releasedate, and they need to explain their previous installat
Re: (Score:2)
Re: (Score:1, Informative)
In response to SecureWorksâ(TM)s admission that their demonstration did not exploit the built-in driver, Apple on Friday released a statement regarding the supposed vulnerability.
If Daring Footba
You need both (Score:1)
For vendors who have proven themselves irresponsible by not delivering fixes in a timely manner, there's no point in waiting, just publish it and let market for
Full Disclosure - but responsibly (Score:4, Informative)
But too often these types are calling for Full Disclosure - immediately! Don't even bother to inform the vendor! RAR! Cry havoc, and let loose the scriptkiddies!
"The bad guy is already going to test and exploit these vulnerabilities long before the public even discovers them - the good guys ought to have a crack at verifying it too."
That is an assumption. The assumption that bad guys know about the vulnerability -before- the 'public discoverer' went with full disclosure. Plus the assumption that the bad guys' work would be as bad, or worse than, what script kiddies would do in the time between your discovery and your disclosure. I don't think those are assumption that can be made, based on - admittedly anecdotal - evidence (crashing mIRC 6.something users' IRC application on large IRC networks using a malformed DCC command only became a problem once it was disclosed and everybody and their dog started doing it, while the developer was already in the process of fixing.)
There's a middle ground - I put it at 3 days. Where do you put it, Jonathan Zdziarski? Your article seems to indicate "0 day", but I can't imagine you being that irresponsible.
Re: (Score:2)
When a malicious party finds out about a hole, there is no 3 day grace. Vendors want to treat security in a casual manner, and that is truly irresponsible.
There is no good reason to put anyone above the public.
Re: (Score:2)
Flaw in capitalism, not industry (Score:3, Insightful)
If anything, this has the trappings of libertarian or democratic socialism. The idea of democracy taking a role in putting moral standards on powerful economic institutions, is not traditionally capitalist.
Re: (Score:1)
The idea of democracy taking a role in putting moral standards on powerful economic institutions, is not traditionally capitalist.
What are you talking about?
We have all sorts of laws in place for consumer protection which place restrictions and obligations on companies. Surely by your definition there are no capitalist countries.
Forcing companies into full disclosure would merely be another level of consumer protection/empowerment regardless of if you agree with it or not.
Re: (Score:2)
Neither is really concerned with consumers (Score:2)
They'd better get used to it because (Score:1)
Fallacy in argument (Score:1)
If the exploits were fully disclosed instead then most likely there would be even more
False dichotomy. (Score:2)