To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.

Well, that's exactly how it tends to work for housing, so I think GP's point is that if it works there it should work here. However, I disagree because the stakes are so different (harming a single family who are free to harden however they like, versus harming the general public who are at the mercy of whatever hardening is done for them).

You let the manufacturer know, and you let them decide for the next steps.

No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business.

In the meantime, you keep it for yourself.

You helped: no lawyers, no problems.

If really there is a safety issue, after a reasonable period of time you can inform the regulators, as it is their job to assess safety.

This is responsible disclosure, not TMZ-style public-shaming.

I found an authentication bypass in a door card access controller. Per the installer I was working with the units are regularly exposed directly to the Internet. (Heck, the installer was trying to cajole my Customer into doing it for "remote support" reasons.)

Given that there's an impact to the public-- albeit not necessarily directly safety-related-- I think this kind of vulnerability is still "my business".

If I owned one of these controllers and it was "protecting" my property I'd want to know.

(Fun aside: The installer went so far as to suggest that because their other Customers expose these units to the Internet-- particularly a small bank who is "audited" for "security"-- it would be okay if my Customer did it. Needless to say, my Customer did not. I let my Customer know about the auth. bypass and we kept the unit locked down in a VLAN w/ a restrictive ACL, but I never publicly disclosed... too afraid of hostile response from the vendor. Eventually a researcher did find it and disclose it publicly, at least...)

That's how security mostly works in meatspace, yes.

In the specific case of internet connected software the industry has a lot of experience saying that if something is exploitable then someone will come along and exploit, so we don't normally need to see an example of it happening in the real world first. It's sufficient to assume that if you get popular enough, a professional blackhat will find your bugs and exploit them. It's also reasonable to assume that the cost of a fix is low and the cost of change in the field is also low.

Outside that context the threat models are usually unclear and refined through experience. If you notice someone cut through a wire fence to steal some equipment from a cell tower maybe you build a wall around it instead. But if nobody is stealing anything there's no point in pre-emptively trying to guess that it might happen and building lots of walls because that might just be a waste of resources (perhaps there's no market for stolen tower equipment, so protecting it better would be a waste of resources).

Anyone operating infrastructure hardware is negligent if they won't take basic measures to harden it against disclosed threats.

I’m not worried about malfeasant citizens mucking with the traffic lights, there are simpler ways to make mayhem. But in the event of a war, you can bet every unpatched vulnerability in your infrastructure will be used against your country.

You either research these vulnerabilities (and you have limited capacity and knowledge) or you purchase vulnerabilities from vendors, exchanges and "research companies".

In such case, it was an unnecessary free gift to an enemy state or a malicious actor.

The same with NSA, they do not know all the vulns of the universe (due to budget, resources, or simply focus).

You may actually have some vulns they are interested into but unless someone points these vulns to them, they will not get aware that they exists.

Yeah, but in youtube space, there are, eg, lawyers who are into lockpicking who post smug videos showing how vulnerable various manufacturers' locks really are to common lockpicking techniques. Apparently 4.5M subscribers are quite happy being informed what the state of lock security is out there.

https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

But the person finding the vulnerability and notifying the company is the smug one. :)

Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"

If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.

"We will push an update to Flipper Zero for this, the right moment.

Thanks to the Flipper Zero, we have millions of devices in the wild that we can remotely control and send signals from. Just wait."

Sure, because the chances of getting punched out, shot, or reported to the cops is significantly higher. Given how trivial it is to quietly attack across the network, I think the analogy with meatspace makes little sense.

These systems affect lots of people, it's a public safety issue, and there is a company being paid money by the public to ensure that their systems are safe and secure. They should be tested by everybody and anybody who wants to test them. Especially if they are running on a publicly accessible IP address.

Also if you want to test the locks on someone's house, you don't go to their house. You buy the locks that they are using, and test them quietly in your own location.

This is a pretty great point, because it's exactly what the guy in the article did to find the vulnerability in the traffic controllers.

AKA what criminals already do, except the criminals actually break into the random peoples' homes and steal their stuff.