4

I had heard a lot about Google's project zero and it's 90 day deadline for vulnerability disclosure. It has taken some flak from Microsoft for disclosing the bugs before they were patched.

I understand the argument that users should be aware of the risk that is present in using a flawed software and that definitely is a pro towards responsible disclosure.
At the same time I believe that if you disclose a vulnerability especially in a closed source software before a fix is released, the users become sitting ducks. High value targets using these systems can come under serious trouble because of this.

Responsible disclosure with a fixed deadline seems to be a popular concept in the industry. I wanted to know what are the pros and cons of this approach.

  • (The opposite of "responsible disclosure" is called "full disclosure".) – Arminius Dec 11 '16 at 4:32
  • @Arminius en.wikipedia.org/wiki/Responsible_disclosure says that it is similar to full disclosure with the key difference being in timeline agreement. My problem is with any sort of disclosure till a fix is released. – Limit Dec 11 '16 at 4:35
  • I see. I just felt the term "full disclosure" should appear somewhere since it's the most "radical" form and the problem is often framed in a responsible vs. full disclosure argument. – Arminius Dec 11 '16 at 5:41
5

The main argument for a fixed deadline is probably that history shows that many vendors will take ages to fix software if no hard deadline is set for disclosure. Since it is likely that others will find the same bug too (or have already found and use it) this means that users are at increased risk without being aware of it. This also means that they will not add additional defenses to deter the risk, like increased monitoring, replace affected software with a more secure one, or reduce the risk by temporarily taking affected systems or services offline.

The main argument against a fixed deadline is that some bugs are more hard to fix than others and thus fixes take more time and that maybe there are no effective workarounds for the customers. Thus customers have an increased risk while the vulnerability is known to the world and thus potential attackers but no fixes or workarounds exist. But at least they can be aware of this additional risk. Past has shown that if this is the case it is often sufficient if the vendor works closely with the security researchers to get the problem fixed as fast as possible. And if past experiences with the vendor where positive the researchers often extend the deadline a bit this one time.

Regarding the Google Zero Project: one might complain about their hard deadlines but if you look at the work they do and how fast most vendors react to the bugs found the strategy of a hard deadline seems to be successful: many bugs are fixed within a few days, i.e. much shorter than the deadline. And I very much doubt that this would be the case if the pressure of the deadline was not there.

  • 1
    Thanks! I feel like the argument here would revolve around the central theme of adding pressure on the vendor to provide a timely fix. Other arguments (if any) would be low in impact so marking this as the correct answer. – Limit Dec 11 '16 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.