Re:The NSA Is Hoarding Vulnerabilities
by schoen on Friday August 26, 2016 @11:36AM
(#12366959)
> It would be like saying studying malaria and not reporting your findings makes people less healthy.
That isn't necessarily an absurd thing to say in some circumstances, but let's take a different angle.
A striking difference between information security and microbiology is that the information necessary to attack someone and the information necessary to defend against attacks are almost identical. (People can develop an exploit from a patch, or a patch from an exploit, in a matter of days or hours. And they expect to be able to do so; if we had a working exploit or a detailed vulnerability description, we'd be very critical if a vendor couldn't patch promptly solely on the basis of that information.)
In microbiology, there is a relationship between these two kinds of research or capability, and biomedical researchers sometimes produce more virulent pathogens as part of their research, but overall the relationship is dramatically more attenuated. There are pathogens that researchers have had samples of for decades that they still haven't produced a successful prophylaxis against. And just having drugs that treat infection, or vaccines, doesn't automatically allow someone to cause infections or epidemics.
That isn't necessarily an absurd thing to say in some circumstances, but let's take a different angle.
A striking difference between information security and microbiology is that the information necessary to attack someone and the information necessary to defend against attacks are almost identical. (People can develop an exploit from a patch, or a patch from an exploit, in a matter of days or hours. And they expect to be able to do so; if we had a working exploit or a detailed vulnerability description, we'd be very critical if a vendor couldn't patch promptly solely on the basis of that information.)
In microbiology, there is a relationship between these two kinds of research or capability, and biomedical researchers sometimes produce more virulent pathogens as part of their research, but overall the relationship is dramatically more attenuated. There are pathogens that researchers have had samples of for decades that they still haven't produced a successful prophylaxis against. And just having drugs that treat infection, or vaccines, doesn't automatically allow someone to cause infections or epidemics.