News for hackers. Stuff that matters.

A comment on Behind the Masq: Yet More DNS and DHCP Vulnerabilities. Parent comment

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by peterwwillis on Monday October 02, 2017 @04:23PM (#15387583)
I'm not against people patching things themselves. But my grandmother can't apply patched source code to the firmware for her Belkin cable modem. And I sure as hell can't patch the firmware for my carrier's locked Android phone. My Smart TV is probably just fucked. If these vendors were contacted before release, they may be able to keep people safe at publishing time.

What you seem to be suggesting is that we should simply all disconnect from the internet until vendor patches can be prepared, the reason being it's better to stop any potential and unknown exploits going on now, than stop the hundred-fold new exploits that absolutely will follow its public announcement.

[ Parent | on HN ]
Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by viraptor on Monday October 02, 2017 @05:44PM (#15388224)
> If these vendors were contacted before release, they may be able to keep people safe at publishing time.

You mean if hundreds of the popular vendors were notified for a coordinated release? And you think that's not making the exploit effectively public? Even skipping possible monitoring of emails, I don't expect that the set of blackhats and employed security engineers have no common elements.

[ Parent | on HN ]
Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by abugher on Tuesday October 03, 2017 @02:43AM (#15390635)
Good point. Does that mean there should be zero coordination? What about coordinating with the security teams for a few big Linux distributions? That would be a much smaller list of people, and might make it easier/quicker for some commercial vendors to get fixed once the public announcement is made.
[ Parent | on HN ]
Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by irundebian on Tuesday October 03, 2017 @10:10PM (#15397780)
The problem is that we don't have any laws forcing vendors to keep their products (smartphones, TVs, embedded (networking) devices up to date. It's high time to change that.
[ Parent | on HN ]