Microsoft to banish 'responsible' from disclosure debate

WTF

So we want to replace an emotionally ladened phrase that we understand with a dry, technical phrase that we don't understand. That will help protect the customers!

It's all in the way you interpret it.

"The hope is that software makers and researchers can put aside decade-old differences about the best way to handle critical defects so that end users are best protected."

Translation:

The hope is that software makers and researchers can put aside decade-old differences about the best way to handle legal terminology so that software makers and researchers are best protected.

Yep, now that makes sense.

Ceci n'est pas un titre

All they're doing is eliminating the oxymoron "responsible Microsoft". Business as usual.

Good for them

"So we want to replace an emotionally ladened phrase that we understand with a dry, technical phrase that we don't understand. That will help protect the customers!"

*shrug* "responsible" disclosure doesn't protect customers no matter what it's called, since companies then just sit on some flaws for years, while blackhats exploit them freely.

Anyway, good for them. Coordinated vulnerability disclosure is dry but at least accurate.. whereas "responsible disclosure" causes so many debates between people like me that say letting everyone know about flaws ASAP is good, the blackhats probably already know, and therefore letting a company sit on the flaw for potentially months or years is *irresponsible*. And them, who say they should take as long as they want to fix a flaw so it's irresponsible to tell anyone until that point. (Personally, I would not disclose immediately, but if there's no substantial response in a week or two, well, someone like the full disclosure mailing list has to know... and to add to this, MIcrosoft in particular is irresponsible for only releasing patches once a month instead of as soon as the patches are ready.)

"We're really trying to reach out..."

...with our tentacles."

Delayed disclosure isn't a responsibility, it's a courtesy. And the less courtesy Microsoft show, the less they'll receive.

Is it possible that someone with half a brain there has figured out that pissing and moaning about immediate disclosure is a sure way to encourage it?

I'm guessing not, actually, and that this is just PR flim flam to try and get vulnerability researchers enfolded in the loathesome Embrace of the Beast.

Apple, Mozilla, Google, Adobe..

it's not just MS here. Every software company potentially has security problems. Every vendor probably want's to minimise churn dealing with them and the bad PR of having some random dude yelling that the sky is falling and you must unplug the internets or your cat will get microwaved

All that's going on here is that Microsoft and Google and others want to improve the process without security researchers blackmailing them with a threat of premature disclosure... which is always going to be tempting for the security wonks because it brings them their 15 minutes of fame

Reporting a bug on a Saturday, and then putting every user at risk because the vendor hasn't committed to make unknown changes 3 business days later... is that responsible behaviour and the actions of someone who wants to keep you safe vs someone who wants their ego stroked?

I would however love to see an indepenant body with no axe to grind who collates these reports and tracks responsiveness and makes sure that bugs are fixed and researchers credited when the fix is announced and - if a vendor and researcher don't agree to a timeline - manages disclosure in a considered manner (ie describe the vector at a high level, symptomns and workarounds. If that doesn't solve the problem then a gradual escalation to make proof of concept available to anti-malware vendors to enable them to create appropriate defenses.

Public disclosure of a working attack no matter how "pure" you claim your motives to be is just putting everyone at risk

Microsoft to banish 'responsible' from disclosure debate

"We all want to protect customers and users"

Dear Microsoft:

Well why not start by designing secure software in the first place? From the "brain" virus, through Wordbasic macro viruses to the latest USB vulnerability, Microsoft have ALWAYS put "speed to market" first and security last. This latest step in the Redmond game is more "blame the messenger" posturing, and as such clearly does not represent any change from the sloppy security practices of old.

How many more messengers will get the blame before the world wakes up and stops buying inferior products at elevated prices from the Gates/Ballmer crowd?