I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some focus time from the various sauron-esque eyes that are corporate attention by converting a 'bug report' into an 'impending pr nightmare bomb with a known timer'. It's a similar hack to complaining on twitter to deal with a marketing department instead of calling in to a customer service line that's just trying to get you to go away.

> It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".

The point of calling it responsible is to defend the researchers who have massively less power in the relationship against the vendors. Even now you'll see whitehats lambasted for eventually disclosing after a vendor dragged their ass. Beyond that, yeah you can't please everyone.

The point of calling it "responsible" has nothing to do with defending researchers; it's literally the opposite. The norms of "responsible" disclosure were absolutely not the norms of vulnerability reearchers of the time. The term was invented back in the early aughts by @stake, then the largest software security consultancy in the world (my company, Matasano, was essentially a spin-off of @stake; one of my cofounders was an @stake cofounder).

This is one of those things, like "Zero Trust Networking", where people read the term, (reasonably) believe they understand what the words mean, and then axiomatically derive the concept. But, no, the concept has its own history and its own meaning; the words have little to do with it (except that here, it's especially obvious what's problematic about the words themselves).

The industry has largely moved away from "Responsible" disclosure to "Coordinated" disclosure, for all the reasons I've given here. Even CERT, the most conservative organization in software security, uses the new term now.

Later edit

This originally read The norms of "responsible" disclosure were absolutely not the norms of "Responsible Disclosure", which was a typo.

Yes, CERT has moved using CVD, but I argue that's because of their conservationism. They don't want to rock the boat and tend towards vendor friendly, neutral language. That makes sense for their niche.

And just throwing it out there that the older term that's actively being erased because its implications are unfriendly to entrenched interests isn't the "Orwellian" one.

Here's the 2002 I-D that Weld worked on with Steve Christey standardizing the term. It's notable for being roughly contemporaneous with @stake firing Dan Geer over, as I recall, somehow alienating Microsoft, one of @stake's larger clients.

https://cve.mitre.org/data/board/archives/2002-02/msg00026.h...

Your link, for what it's worth, doesn't use the term at all. But even if it had, it wouldn't change anything.

Just to keep this on track: your claim was that "Coordinated Disclosure" --- the near-universal standard term for what used to be called "Responsible Disclosure" --- is an "Orwellian re-imagining". Leaving aside the fact that there's nothing intrinsically "Orwellian" about renaming something, the fact remains: "Responsible Disclosure" was researcher-hostile and patronizing, and has been chucked out the window by almost everybody who matters in vulnerability research.

We've managed to hash out a hot topic from, like, 2012 on this thread, which is great, it's progress, we move forward bit by bit here on HN, just like Joel Spolsky once said; "fire and motion". But we can probably be done now.

Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.

And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays.

Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.

Well, Crowdstrike is supposed to catch and prevent that...

Hooking a token into their uninstaller is hardly sufficient... I have SO much surface area to attack that I don't genuinely think you can call this anything other than trivial.

For an admin user, I'd take this token prompt more as a "Hey - you're about to violate company policy" more than any literal technical restriction.

I can steal the network, change the registry, simply delete their binaries, update shared dlls, or any number of other easy hacks to get them offline.

This is trivial.

That's a bold claim. Mostly incorrect, but bold. A proper Windows endpoint protection software's Registry filter will prevent you from modifying its Registry data; its filesystem minifilter will prevent you from modifying its files; its EXEs will use the Windows mitigation policy that loads only Microsoft-signed DLLs; its connection with its management server will be encrypted and signed with known keys/certifications (rather than trusting everything from the Windows Certificate Store), etc.

An admin can still bypass all of that with enough effort but it's not nearly as trivial as you say. What is trivial that you can't actually do the things you said and it's common knowledge (in the field).

If you don't want people to modify the machine - don't give them admin access.

If you give them admin access... don't assume they won't modify the machine.

For comparison - I worked software security for 5 years dealing with fortune 100 banks. I have zero faith in the industry. It's mostly a shell game for liability.

I can absolutely do the things I mentioned above. At best, it's a discussion of how hard I'll have to work. So again... this is basically a "hey - you're about to violate company policy" notice.

Heartbleed is older (2014).