undefined | Better HN

0 pointslondons_explore6y ago0 comments

I think it depends on if the agreement is to delay the announcement, or hide the announcement forever.

If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.

0 comments

microtonal6y ago

If I were a researcher, I'd be happy to delay for 6 months for a reward

Really? What if a nation state actor has discovered the same bug. Do you want to keep the world vulnerable for a 6 month window?

Also, most European university researchers are funded through taxpayer money. They should do what is best for the general population, not what is best of some company's stock value.

londons_exploreOP6y ago

> Do you want to keep the world vulnerable for a 6 month window?

There exist far more bugs than discovered bugs. By revealing it, I put some people at risk (those who fail to update), and by hiding it I put more people at less risk (everyone, but only if someone else discovers the bug).

It's a tradeoff, but 6 months is a good window for most people to update, while there still not being too much chance of the bug being independently discovered.

krageon6y ago

> most European university researchers are funded through taxpayer money

This is absolutely not a given. While it might be partially true, they are frequently also funded through corporate grants.

dagw6y ago

The only European country where I'm somewhat familiar with research funding is Sweden and at least there direct corporate funding is a tiny sliver of the overall university research budget. And even when companies do fund research projects much of the funding is things like letting their researchers work 'for free' on the project or giving free access to data, equipment and licenses rather than cash

1 more reply

nullwasamistake6y ago

It became morally bad to delay any longer once it was obvious that multiple teams were finding the same bugs. There's a crap ton of people listed as discoverers in the CVE's.

Who knows how many other actors discovered the same bugs and didn't say anything? Likely multiple, honestly.

We've finally run into a real life proof of why bug embargoes are bad. This is the first time I know of that multiple people independently discovering the same thing before the embargo period was over.

krageon6y ago

Saying something is "morally bad" doesn't really make sense unless you also define the moral framework that it is bad in. As you did not do so, it reads as if you expect the reader to understand what morality it is bad in (maybe even that it is obvious).

nullwasamistake6y ago

Hiding bugs that bad actors likely know about is morally bad in NY book

krageon6y ago

This money was also meant for downplaying the severity of the vulnerability, allowing intel to spin the discovery and lose less face. This is a politically charged bribe, their bug bounty program has been constructed to lend credibility to it.

j / k navigate · click thread line to collapse

0 comments

microtonal6y ago

If I were a researcher, I'd be happy to delay for 6 months for a reward

Really? What if a nation state actor has discovered the same bug. Do you want to keep the world vulnerable for a 6 month window?

Also, most European university researchers are funded through taxpayer money. They should do what is best for the general population, not what is best of some company's stock value.

londons_exploreOP6y ago

> Do you want to keep the world vulnerable for a 6 month window?

It's a tradeoff, but 6 months is a good window for most people to update, while there still not being too much chance of the bug being independently discovered.

krageon6y ago

> most European university researchers are funded through taxpayer money

This is absolutely not a given. While it might be partially true, they are frequently also funded through corporate grants.

dagw6y ago

1 more reply

nullwasamistake6y ago

It became morally bad to delay any longer once it was obvious that multiple teams were finding the same bugs. There's a crap ton of people listed as discoverers in the CVE's.

Who knows how many other actors discovered the same bugs and didn't say anything? Likely multiple, honestly.

krageon6y ago

nullwasamistake6y ago

Hiding bugs that bad actors likely know about is morally bad in NY book

krageon6y ago

j / k navigate · click thread line to collapse