EFF Pries More Information on Zero Days from the Government

https://www.eff.org/deeplinks/2016/01/eff-pries-more-transparency-zero-days-governments-grasp

by tghw • 11 years ago

124 29 11 years ago

blakesterz• 11 years ago

I love the EFF and what they do but I always feel like their writing style is so often... I'm not sure how to put it... just kind of over the top? e.g. first paragraph, "the charade is over" ... third "this too doesn’t exactly come as a shocker." So much of what they write about is really important but I can't help but think the writing is often maybe too hyperbolic and turns off people that should be following these things closer.

pc862• 11 years ago

How much of the organization's funding is based on donations? That may be part of why most articles have this Chicken Little "the end is near" type of theme to them.

rm_-rf_slash• 11 years ago

Agreed. While I find the EFF's general tone to be a bit too hyperbolic (something about their mission and site design makes me think their writing would be better served by a level-headed style akin to a BBC article), at the end of the day I am grateful for the work that they do and if they have to be a little melodramatic to spur donations, then so be it.

zitterbewegung• 11 years ago

Putting the hyperbole in not only makes people click on it but it makes people be more swayed not only by reason but also by feeling . Sharing the article probably makes a significant people Donate to the organization. Disclaimer : I am an EFF member.

dhimes• 11 years ago

I suspect they A/B tested it and went with what works.

mikeash• 11 years ago

It sways people away because of feelings, too. I admire what the EFF does but I always have a hard time taking them seriously because of this.

Also, at some point, I think integrity demands reasonable language even if hyperbole is effective. It ends up being a variation on clickbait.

JumpCrisscross• 11 years ago

I respect their opinions, but similarly can't make it past a few paragraphs of their PR pieces. A valuable membership benefit, for me, would be a level-headed newsletter re-writing their PR wires.

carc• 11 years ago

I've always felt the exact same way. I can rarely get through anything they send me because my natural reaction is to trust what I'm reading LESS when the writing is in that tone.

TazeTSchnitzel• 11 years ago

I'm not sure if it's the right word, but EFF's stuff reeks of... triumphalism?

Even the tiniest improvement is always hailed as this massive victory.

In fairness, this is something many political groups are prone to.

JamesSwift• 11 years ago

As a peripheral observer, I do find myself discounting a lot of what I read from them exactly because of this.

Animats2• 11 years ago

This changes what "responsible disclosure" of security bugs means. It's no longer appropriate to report security bugs just to the vendor and CERT. They must be disclosed publicly to prevent them from being misused by government. It's now irresponsible to delay disclosure.

fweespeech2• 11 years ago

Giving the vendor (60 days) to fix it is reasonable.

riskable• 11 years ago

The "reasonableness" behind the length of time before public disclosure of vulnerabilities is not based on how long the vendor will take to fix it. It is based on the likelihood that someone else will discover the vulnerability (if not already!) and exploit it.

We must operate under the assumption that if "a good guy" has discovered a vulnerability in a product then "a bad guy" will also find it before long. That "before long" part is really just an assumption based on the best-case scenario: No one else has discovered the vulnerability yet.

Even if the vendor has no fix available disclosure is still of the utmost importance because it gives the public at large a fighting chance at remediating the problem; whether the vendor is ready or not!

Example: If a critical vulnerability is discovered in Nginx and the developers can't put out a release any time soon I can always switch to Apache or some other web server. How "entrenched" or "locked in" you are with a product is neither here nor there. That's your own damned fault if you can't swap it out with something else. Especially if you knew you were locked in ahead of time and have yet to do anything about it.

sarciszewski2• 11 years ago

In general, yes. Sometimes longer is reasonable, sometimes shorter is reasonable.

tptacek4• 11 years ago

No, this has very little at all to do with reporting to vendors. The USG doesn't have a stockpile of vulnerabilities because vendors give them vulnerability feeds (in fact, there's no evidence that anything like this has ever happened, and that's not surprising, because to make that work, vendors would need to knowingly retain vulnerabilities in software they ship to their customers). The USG has a stockpile of vulnerabilities because it employs researchers and buys vulnerabilities from outside researchers.

That is exactly what the newly unredacted VEP the EFF is writing about says: agencies discover vulnerabilities and report them to an internal clearinghouse. That may or may not result in alerts to vendors.

Reporting to vendors remains a solid way of killing vulnerabilities, so long as researchers are aggressive about it (the 60-90 day open publication window seems to do the trick).

(This is my field).

viraptor• 11 years ago

While it's not stockpiles of vulnerabilities, I don't think it's valid to say there's no evidence of vulnerability feeds. For example a bigger company can get early notification of embargoed vulnerabilities for various projects they use, sometimes with early patches.

I'd be surprised if USG didn't have access to pretty much every important feed like that. This gives every notified party at least a few days to act. (defence or otherwise)

sarciszewski2• 11 years ago

No, this has very little at all to do with reporting to vendors.

Right, and what little it has to do with reporting to vendors is this: If you want to throw a wrench in the surveillance apparatus, instead of selling privately, disclose to the vendor to spite the government.

But that's not to say that reporting a vulnerability to MITRE/CERT is going to land a 0day in the hands of the NSA. (But on the other hand, if you're lucky, you might kill a vector they were already using.)

jlgaddis2• 11 years ago

Do you think that it is likely that NSA, et al., are NOT monitoring messages sent to the security/vulnerability reporting e-mail addresses that many vendors publish?

Knowing what we do just from the Snowden disclosures, monitoring those aliases is exactly the type of thing I would expect them to do. Even if they only get 60-90 days before a vulnerability is "killed", that still leaves them a fair amount of time to utilize them against their targets.

EFF Pries More Information on Zero Days from the Government

Related Stories