For example, the Tor network has recently been hit by a reveal of a major exploit in a research paper.

Isn’t publishing the details on the exploits completely counter-productive as the developers of Tor can then find the exploit and issue a fix? Would it not be better to not publish a paper and instead work with the authorities?

For the record, I don’t have anything against Tor as I think anonymity can be a good thing if the user doesn’t do anything illegal. Unfortunately, not everyone is like this. Secondly, I am also aware that research companies like to publish papers to increase their reputation within the community but I am asking if their hard word would be more effective if they didn’t share their results with everyone.

This is mostly out of curiosity and may be considered a *personal-opinioned question* in which case I will happily delete this post.

closed as primarily opinion-based by Iszi, user45139, Xander, RoraΖ, Mike Ounsworth Aug 27 '15 at 20:54

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The TOR network was created by the US Navy and still gets substantial funding from the US government. I wouldn't call that illegal! But depending where you live, this might differ. Most of this papers are published by US, European or Israeli researchers. I don't see them working with the Authorities of a country like North Korea, Iran, China, ... where TOR would be considered illegal! – Josef Aug 27 '15 at 10:18
  • I overlooked that point about Tor, but still I consider it ironic that the US government funds a network which has infamously been linked to drug marketing, paedophilia abuse etc which could hinder the efforts of a police agency such as the FBI. Certainly these published papers wouldn't be helping the FBI? – Joseph Aug 27 '15 at 10:31
  • 4
    Well, I consider it ironic that the British government still funds the road-network which has infamously been linked to drug marketing, paedophilia abuse etc. But then, if you need to go somewhere or maybe need an ambulance fast, you might consider that a lot less ironic. It seems the TOR network is a very valuable tool for parts of the US government (say, spies...) and so they fund it. – Josef Aug 27 '15 at 10:38
  • @Josef - Haha touché :) – Joseph Aug 27 '15 at 10:38

I think you partially have the idea.

This reminds me of when I saw aircrack-ng being released and many criticized that it would be used maliciously and perhaps to some extent it has. However, you can look at the way wireless security has grown and has actually become considerably more secure, simply from the amount of awareness.

Another example, is the that for a pentester it might be needed to have a working vulnerability && exploit to demonstrate and produce a report where they're trying to convince real change and awareness of real impact. Pentests I don't think would hold their impact and effectiveness if they were a simple CVE read on a potential vulnerability and no real tangible action behind them.

Crackers and miscreants always share exploits and it doesn't take long for some tool to be floating around. If it is let out, then it will get fixed and not ignored.

Usually, for wordpress I see this , where some one will compromise a functionality in wordpress and spill it the forums with out following a procedure of notification and remediation of the vulnerability.

This can be accidentally done and the author may not know that the vulnerability is known and usually are just wanting to talk about what they found while being curious.

I suppose in short, some motivations include . To raise awareness, show off, make a real fix, or share curiosity.

  • You make a good point about raising awareness, thank you for your answer :). +1 – Joseph Aug 27 '15 at 10:25
  • Also often the same exploit will be found by different people at the same time (maybe because there is a new technique or tool to search for bugs) and so if the bug is in something you use yourself, you will become vulnerable too. It would make sense for the Authorities to know about unpatched TOR exploits only if the same Authorities are not relying on TOR too. – Josef Aug 27 '15 at 10:44
  • Another potential motivation is that for researchers (either academic professors, or otherwise publicly funded) your funding basically depends on how many papers you publish, so there's huge personal gain in publishing a paper with a large view-count. – Mike Ounsworth Aug 27 '15 at 12:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.