upvote

points

by lambda18 hours ago |
comments
upvoteby john_strinlai15 hours ago|
next
[-]
>they should do a proper coordinated disclosure.

they did a proper coordinated disclosure, following the industry standard 90+30 process. that is why the exploit dropped 30 days after the patch landed.

the kernel team should have communicated with their downstream about the importance of the patch. that is the kernel security team's responsibility -- and they are much better positioned to do that than crossing your fingers and hoping every reporter will contact every distro every single time there is a vulnerability.

there are very good reasons disclosure works this way, backed by a couple of decades of debate about it.

reply
upvoteby lstodd3 hours ago|
parent|
[-]
how many times it has to be said that it is impossible for linux kernel to communicate with anything but a minuscule portion of its downstream and _that_ has been done?
reply
upvoteby selectively18 hours ago|
prev|
[-]
Who cares about how you are seen when you are selling 0day for big bucks? The bad actor makes more money than the 'legitimate' one without breaking any law. Punishing someone who didn't alert distros despite a patch being available encourages the company to simply find flaws and sell them for profit - it pays more to begin with.
reply
upvoteby _yttw18 hours ago|
parent|
next
[-]
If they want to take advantage of disclosure for marketing, they're either going to need to accept the norms around responsible disclosure, or they're going to need to accept how shirking those norms will come off. That's life in society. Sometimes it's annoying and sometimes it doesn't feel rational, but these norms have been negotiated throughout the history of our industry and are the way they are for reasons good and bad.

I just don't see the point in complaining about how shirking the norms of your industry will make you look irresponsible. I don't really care that they could have decided to sell the vulnerability instead. It isn't material.

reply
upvoteby tptacek18 hours ago|
parent|
next
[-]
It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsible disclosure" is an Orwellian term cooked up between @Stake and Microsoft and other large vendors to coerce researchers into synchronizing with vendor release schedules. It was fantastically successful at that, and it's worth pushing back on at every opportunity.

Tavis Ormandy dropped Zenbleed right onto Twitter. He's doing fine. You can blacklist him if you want; I imagine he's not going to notice.

reply
upvoteby SCHiM17 hours ago|
parent|
next
[-]
Microsoft's policy is: "if you contact us with a vulnerability, you automatically agree to the terms of our responsible disclosure policy", which includes waiting 30 days after patch was created, and says nothing about how long that process takes.

There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all...

reply
upvoteby robocat4 hours ago|
parent|
next
[-]
> terms of our responsible disclosure policy

I couldn't find a public copy of that.

The best starting point I found for reporting vulnerabilities was: https://github.com/microsoft/MSRC-Security-Research/security...

You can email without agreeing to anything. But for a serious issue Microsoft would obviously try and track down who you are and what jurisdiction you are in.

reply
upvoteby SCHiM4 hours ago|
parent|
[-]
https://www.microsoft.com/en-us/msrc/bounty-guidelines

> MICROSOFT BOUNTY TERMS & CONDITIONS

> Last updated: July 23, 2025

> The Microsoft Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Microsoft Bug Bounty Program (the "Program"). These Terms are between you and Microsoft Corporation ("Microsoft," "us" or "we"). By submitting any vulnerabilities to Microsoft or otherwise participating in the Program in any manner, you accept these Terms.

Who knows if its enforceable.

reply
upvoteby leni5361 hours ago|
parent|
[-]
This seems to be sloppy wording, with the intent of "we only offer the bounty under these terms". Maybe my interpretation is too charitable.
reply
upvoteby leni53617 hours ago|
parent|
prev|
next
[-]
I wonder if "if you contact us... you automatically agree" stands in court. That's just ridiculous.
reply
upvoteby tptacek17 hours ago|
parent|
[-]
Reader, it does not.
reply
upvoteby prmoustache15 hours ago|
parent|
prev|
[-]
Since no contract is signed, this is just pure fantasy from your part.
reply
upvoteby _yttw18 hours ago|
parent|
prev|
[-]
You're right, they don't need to. They have an alternative, to accept what people say or think about them in response. That's what I said.
reply
upvoteby expedition3213 hours ago|
parent|
[-]
So how do we feel about Linux distributors who have their heads up their asses and sat on their hands for 30 days?
reply
upvoteby selectively18 hours ago|
parent|
prev|
[-]
Those norms do not exist. Those are people asking companies to do stuff to benefit the person complaining for free, and many companies will not do that.
reply
upvoteby _yttw18 hours ago|
parent|
[-]
It seems to me you're unaware of them, but there are strong norms around disclosure. They've been discussed for decades. It is the expectation that vendors would be notified in a scenario like this.
reply
upvoteby selectively18 hours ago|
parent|
[-]
No, there are users who want those to be norms. Qualified researchers happily sell substantive vulns to people who pay (Governments/Cellebrite and companies like that) enough to quell any complaint.
reply
upvoteby _yttw18 hours ago|
parent|
[-]
Which is again, irrelevant to the question of how disclosure works and what expectations there are around it because that is not disclosure and is not what was being discussed.
reply
upvoteby dirasieb18 hours ago|
parent|
prev|
[-]
it’s called building and preserving a high trust society, you wouldn’t understand
reply
upvoteby DaSHacka14 hours ago|
parent|
[-]
How does someone being incentivized to sell a vulnerability to a private organization over disclosing it publicly preserve a "high trust society"? Do you mean in the context of a "deceptively high-trust society"?

Those private actors aren't planning to sit around and hold onto these exploits they've horded forevermore, they're obviously paying for them so they can one day use them.

reply