undefined | Better HN

0 pointsamiga3868mo ago0 comments

I stand by what I said at the time: https://news.ycombinator.com/item?id=43492940 - and if you only read one thing, read the harrassment an atop contributor was subjected to by "eslerm": https://github.com/Atoptool/atop/issues/330#issuecomment-275...

I bring it up because of the unmissable parallels. Google are trialling a policy to see what will happen, but this incident shows already what can happen.

RbtB is a trusted blog by the HN crowd, and her vaguepost unexpectedly whipped up hysteria. It was only quelled by a post with more details the next day. Google Project Zero has enormous levels of trust, intends to vaguepost as policy, and not post more details the next day to satisfy the mob.

It does not look good for volunteer maintainers to suffer an entire world of talentless clowns rifling through every commit and asking "is this the bug Project Zero found?"

0 comments

tptacek7mo ago

The "Rachel By The Bay" blog and Google Project Zero are not reasonable comparands in matters of vulnerability disclosure.

amiga386OP7mo ago

I think it's a fair illustration of what irresponsible disclosure looks like.

I expect Project Zero will be monitoring carefully; for all their good intentions, this policy trial has the potential to go as badly wrong as the atop disclosure did, for everything they announce.

You can reasonably expect massive, worldwide scrutiny in anything P0 announces has a vulnerability in it without also disclosing the vulnerability, and this extra attention has the potential to overwhelm FOSS maintainers, even if they have fixed the vulnerability and are waiting for coordinated disclosure.

tptacek7mo ago

"Responsible disclosure" is an Orwellian term made up by vendors to coerce vulnerability researchers into working for and on vendor release schedules.

1 more reply

j / k navigate · click thread line to collapse

0 pointsamiga3868mo ago0 comments

I bring it up because of the unmissable parallels. Google are trialling a policy to see what will happen, but this incident shows already what can happen.

It does not look good for volunteer maintainers to suffer an entire world of talentless clowns rifling through every commit and asking "is this the bug Project Zero found?"

0 comments

tptacek7mo ago

The "Rachel By The Bay" blog and Google Project Zero are not reasonable comparands in matters of vulnerability disclosure.

amiga386OP7mo ago

I think it's a fair illustration of what irresponsible disclosure looks like.

I expect Project Zero will be monitoring carefully; for all their good intentions, this policy trial has the potential to go as badly wrong as the atop disclosure did, for everything they announce.

tptacek7mo ago

"Responsible disclosure" is an Orwellian term made up by vendors to coerce vulnerability researchers into working for and on vendor release schedules.

1 more reply

j / k navigate · click thread line to collapse