Spurned security researchers form anti-MS collective
There's power in a union
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Updated Security researchers irked by how Microsoft responded to Google engineer Tavis Ormany's public disclosure of a zero-day Windows XP Help Center security bug have banded together to form a group called the Microsoft Spurned Researcher Collective*.
The group is forming a "union" in the belief that together they will be better placed to handle flak from Redmond and elsewhere following the publication of security flaws. A statement, published by The Windows Club blog, explains the Collective's stance.
“Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft-Spurned Researcher Collective," it said. "MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer.”
Last week the researcher published a zero day flaw affecting Windows Vista and Windows Server 2008. The unpatched security bug creates a means for hackers to crash affected systems and stems from a security bug in the Windows kernel. Vupen Security, which published an advisory on the flaw but is not part of the collective (Contrary to early versions of this story, Vupen rates the vulnerability only as a moderate risk bug because it doesn't lend itself to remote execution.)
The debate about responsible disclosure of security vulnerabilities is as old as software development. Security researchers argue that by disclosing problems they give end-users a chance to act and put pressure to act on software developers, who might otherwise be tempted to ignore the problem. Software developers (including Oracle, Adobe and many others as well as MS) argue that disclosing vulnerabilities in the absence of a fix imperils users.
To some outside either camp the argument hinges on whether a vulnerability is been actively exploited. The length of time a vendor has had to fix a bug - a period that can sometimes run into months - is also an important factor. ®
* The name of the group is an obvious send-up of Redmond's own Microsoft Security Response Centre.
COMMENTS
Somebody call a waaaaaambulance
So what - some researchers have got their knickers in a twist because they can't be bothered to follow responsible disclosure guidelines.
Personally, when reporting a security issue, I tend to follow rain forest puppy's policy - but I might be showing my age. 5 days to fix an issue may be a little tight - depending on the issue - but rfp's policy suggests that you should refrain from publishing the issue if there are active and ongoing communications between both the originator and the maintainer.
There will always be grey areas about whether a company as large as Microsoft is actively chasing the issue down and sometimes a researcher may release the issue before a fix is ready if they feel that they are getting stonewalled. Some are more precious about it than others.
If you really feel the need to release 0 day exploits into 'the wild' then IMHO you fail as a security researcher. Especially if you seem to be motivated by a desire to cause bad publicity for your competition out of spite (Mr Ormandy).
In other words, if you are a serious practitioner of security, work with the vendor and disclose only when it is patched, when you see it in the wild and you haven't released it or the vendor appears to have stopped actively looking at the issue.
Or, to put it another way, grow up and act responsibly
And get off my lawn you damn whippersnappers!
FUD? Shill?
>>Oh. I see. You're a shill, spreading FUD. This isn't about "market share" or "earnings". This is about providing a secure solution for a given problem. Microsoft fails in the "secure" department, and succeeds remarkably in the "problem" department.
Actually.. to be fair.. you're sounding like a shill yourself. AC is asking for an example and in response you've called him a shill and spreader of FUD.. not something I would expect a proud consultant dealing with multibillion dollar corps.
You got me interested now.. shill.
>>Both manufacturing & IC design build their own proprietary software. I consult for several corporations who wear one or the other or both hats. None use Microsoft software anywhere that matters.
Well, since I've worked in neither industries for a long time I can't really comment on whether they do or don't design their own. But I bet there wouldn't be companies like Agilent, Ansoft and Ansys - who charge upwards of $100k per license for engineering apps - if they did.
Seems to me you're the one spreading FUD here pal.
Err...
Like what? In this particular case, it turned out that after the guy denied that MS had been in touch he let slip that they'd told him it would most likely be the patch tuesday after next that they released the fix. What's the problem? Many linux distros take weeks to move fixes from unstable to stable builds.
The customers want patches released on a regular scheduled basis, rather than ad hoc as MS used to.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
