[ news_security_news ]
Publicizing Software Flaws Still Controversial
David Utter
Staff Writer
2007-08-01
 Security News RSS Feed
To disclose or not disclose publicly has been a topic for security professionals in the technology realm for some time, and both points of view could be correct.
As Symantec researcher Elias Levy noted on the company's security blog, Bugtraq, the mailing list Symantec now owns, has been ticking along for nearly 14 years. It's been a fixture in admin inboxes with its discussions of software bugs, sometimes ones with fixes available, other times not.
That's been the point of difference for those on either side of the disclosure argument. When should a vulnerability be made public?
It seems easy to answer this with "after it's been fixed." The software world hasn't always been open to fixing bugs, as Levy noted:
Software vendors had monetary disincentives to recognize and fix problems. They also honestly believed that their customers would be worse off by making the vulnerabilities more widely available to potential abusers. Proponents of disclosing detailed discussions of vulnerability information, myself included, countered that such acts would clue-in users to the true state of security. In turn, this would kick start the research process that would lead to short-term patches and long-term solutions.
One would be hard-pressed to find one viewpoint better than the other. Criminals have demonstrated in this century that they will create exploits to attack patched flaws, in the hopes of catching a vulnerable system before an admin can patch it.
Whether they would have done so or not depends on who is asked. Those against disclosure have less of an argument today. There are too many people with too many tools attacking software now, especially with Internet access a rule rather than an exception for criminals and everyone else.
Levy thinks attacks will persist as security firms and researchers try to find the best ways to protect the typical non-hardcore techie computer user.
"The situation reminds me of the old saying that you can't make an omelet without breaking some eggs. While that may be true, it is the moral obligation of everyone in the industry to make the omelet by breaking as few eggs as possible," he said.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
