Dancho, thank you for your polite and detailed reply. I was young (and advanced) once also, and therefore would clarify that I meant 'adolescent' as a mode, only. It indeed can strike at most ages
.
I would also say to you that I am not looking for a utopia, and surely not one where we just trust what we find on sites. It is one service you fellows have been giving, to alert the very high level of danger out there today, and at ordinary places.
One thing that does not help this is the state of anti-driveby software. I tried LinkScanner Pro for a while, but it conflicts to the point of blue-screens with Norton NIS 2008. I had a lot of trouble with carelessness and more serious things with HauteSecure, if I would like to like that, and I particularly don't like Haute's attitude about user identified tag-backs for all your connections to sites. A lot of consciousness to grow there if they are to get anywhere.
On this reporting at or before fix time. I think your words say to me that you are in a competitive journalistic or security logger community, where you feel compelled to report because someone else does or is about to.
The inner key to at least this particular facebook situation is that apparently the fix was about to go in at about the same time you reported. I judge that from the patch notification, and think that is what you were probably talking over with your Facebook engineer. Well, all right, for this case, and I am glad to hear you were talking to him.
I also notice that 'Mox' has posted 2 more Facebook xss vulnerabilities since. Where does it stop? Why is the reporting public, until the victim site has a chance to respond?
That is the question of judgement here, of having good judgement. If it is my bank that has the discovery, to use your example, I and they would doubtless wish this to remain non-public until it is fixed. That is the time for the investigator to get the credit they are evidently quite hungry for. That is the responsible time.
There is a much longer interval to judge by, in seeing the victim site themselves being irresponsible. I would think it essential to make the kind of contact you did with Facebook early, and follow on to see the progress. If the victim sits on it, they can know journalism will eventually expose that. The good face of the same relationship is that journalism should paint them in a good light so long as they respond quickly.
A case somewhere in the middle might be Apple and Quicktime. I use it and need it, and also need my machine to be very clean. I don't buy the anti-fanboy hype about QT being some kind of poor design; rather, it is a type of service that is particularly vulnerable, handling so many protocols, and a bit old by the standards of coders who have finally woken up to the kinds of things that were done in quality software 2 decades ago, supported by the software advances like object technology which meant you could write once no-overflow buffers and use them everywhere.
I am glad for attention on Quicktime, to get its vulnerabilities closed, but I am very unhappy when a notice goes out that guess what, there's another Zero-day on it. I finally have to set up my machine carefully (NoScript for Firefox, and plain ban on IE for the times I have to use it) so that Quicktime is there, but will not be exercisable unless I say so, each time. Most people won't do this, and will either deinstall QT or bluff the situation out. It is a very hard cut to Apple if they remove Quicktime, because then Itunes as well refuses to work. So there is a great deal of responsibility in what the security press publishes - both for the business of companies who are bringing our future, and for security itself when a wider community of bandits are told where to look to cause maximum difficulty.
Dancho, I am sure you see the scope of balances and responsibilities laid out here. I appreciate it's not the easiest, and I think the best tactic of all is that call to the victim - that can help calibrate.
In most cases, I feel the fair and effective path, which also gives an unmitigated kudos to whomever digs up the fault - since the are then not having to be ashamed and reviled for shouting before its time - is to publish after the fix is in.
With regards,
Clive (Narr vi)
