The Register is reporting that Mozilla's handling of a recent security exploit that affected both browsers has drawn an unhappy response from the Opera team. "Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory. This gave the Norwegian software developers insufficient time to make an evaluation. [...] Santambrogio goes on to attack Mozilla's handling of the issue, arguing that it places Opera users at unnecessary risk."
At least Mozilla told them of the issue. I personally don't think it's their ultimate responsibility. Definitely obligated to do something... but imagine the kind of action Opera would have if Microsoft found the security flaw.
I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.
I don't see it as an attack. It sounds like Opera didn't respond to Mozilla's notification at all. In addition, it's not Mozilla's obligation to make sure that Opera's secure, and it is their obligation to be open with the community to the extent that they can be while still being secure. Sometimes waiting to disclose can bite you in the end like it did with php a few months back. Add to that the bullshit excuse that you can't evaluate a security risk in one day and I think that Opera's just lashing out because they're embarrassed that they have a security flaw.
by Anonymous Coward
on Monday February 18 2008, @06:40PM (#22469086)
> it's not Mozilla's obligation to make sure that Opera's secure
True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
> it's not Mozilla's obligation to make sure that Opera's secure
True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.
So you think Mozilla told Opera within 24 hours of finding out themselves? If not, then how is Mozilla's users made vulnerable by telling Opera earlier?
That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.
No one is suggesting that Mozilla should have delayed the fix (in order to hold back disclosure).
No, it would have been open and responsible and good if someone at Mozilla had thought to send an email to the Opera dev team a week or two ago saying:
Roses are red, violets are blue We're fixing this exploit and think you should too. Lots of Love, Your secret big red monster Valentine.
No need to coordinate releases, but given that it took them a while to patch it, they should assume it'll take Opera a wee while to, and in the meantime they're leaving members of the public open to exploit.
Members of the public that used to use Firefox, but had to stop because Mozilla never fixed the memory leak and these users were using old machines (NT4, 32 meg RAM) and Open Source was supposed to mean never being obsolete, but it was only the non-open, free Opera browser that offered me a fully-patched, fully working browser.
Agreed, and I think it's a very poor way to handle the situation, from Opera's side. If I were Mozilla, and got this kind of junk after reporting the bug to them, next time around I wouldn't even bother. Someone at Opera owes someone at Mozilla an apology.
I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.
Full public disclosure of security bugs is generally considered the best way to get rapid fixes, and was the entire reason that places like BugTraq were founded. Following standard protocol is not an "attack". Vendors like to assume that you're just maliciously publishing things that would be no problem for their users until you did so. That's untrue.
Many bugs are well-known by black hats before they are found by the good guys. The safest thing for users is to assume that all severe bugs are well-known by the bad guys; when you disclose publically, you give the users a chance to protect themselves even if the software is not yet fixed. I'm not sure of the details of this exploit, but they may be able to protect themselves by limiting their surfing to well-known trusted sites, using an alternate browser, or turning off javascript or whatever. In other cases, some sort of external wrapper or proxy, tighter firewall rules, limiting access to DMZs, or other external steps can help prevent big security problems even without a full vendor fix available yet. It may even be worth it to some users just to forgo using an application for a few days until it's fixed.
Keeping silent until the vendor fixes things might just hurt the user's security situation, and certainly doesn't give the user the option of evaluating the risk and determining whether it's worth ignoring it or not--it forces them to make their usage decision without good information.
Attack? How did any of the Mozilla devs attack Opera - from what I can see no public mention was ever made about Opera having the same issue. Further, why would you encourage others to "attack MS in this way?" - that is stupid and unprofessional. I am a committed Linux user, in my free time I build and test each kernel snapshot as it is released. Why, because I love to get into the guts of the system.
Am I a Windows lover? Not really, but I do bring up an XP image from time to time as a guest on my Linux s
Yes, because it means that people look HARDER for the bugs in both browsers and release information about them to the public faster, meaning they'll be patched MUCH faster than a bug report sent through some behind the scenes emails.
Listen, would you rather they give you no advanced warning? Like chivalry, professional courtesy is all but dead these days. What are they supposed to do? Wait until you get your ass in gear to address the issue? Perhaps letting the weakness be known might actually give you the incentive to make it a top priority bug fix - which is good for everyone.
Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory. This gave the Norwegian software developers insufficient time to make an evaluation. "They did not wait for us to come back with an ETA for a fix: they kept their bug reports containing the details of the exploits closed to the public for a few days, and now opened most of them to everybody," Santambrogio writes.
I'm finding it a bit difficult to feel bad for Opera. Exactly how long does it take to "evaluate" a security issue, especially when someone else goes to the trouble of finding it in the first place, and then notifies you of the issue?
Opera had ample opportunity to roll out a fix...but they dragged their feet (as is their habit). This time, their habit got them burned. Perhaps next time they'll take a notification of a security issue more seriously.
From the Opera developers' description [opera.com] it appears that the Mozilla foundation could have handled things more professionally - Opera was only notified the day before a public advisory was published, and since that time the Mozilla foundation have opened most of the bug reports containing exploitation details to the general public. Judging from the emoticons on Opera's blog, the latter action by the Mozilla foundation is the primary issue here, not that they published the advisory.
Opera was only notified the day before a public advisory was published, and since that time the Mozilla foundation have opened most of the bug reports containing exploitation details to the general public. Judging from the emoticons on Opera's blog, the latter action by the Mozilla foundation is the primary issue here, not that they published the advisory.
I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.
The fact that they hid the bug reports at all should be enough to make the Opera kids grateful. After all, the Mozilla foundation operates in a pretty open and transparent fashion. The most honest (and destructive) way to go would be to never hide the bug reports.
But just to cover that old ground once again; when code changes, diffs happen automatically, and people know just precisely what changed. You can be sure that some of those people are malicious hackers looking for new ways to screw us all; there's good money in it. So by hiding the details of the exploit, you make sure that only the more skillful and malicious hackers have the exploit. Does that sound like a good idea to you?
You know, looking at Mozilla's release, they didn't seem to mention anything to anybody about Opera having a problem too. Looks more like Opera screwed themselves.
But allowing only one day is excessive. Can you track down and fix security problems in your software within one day of notification?
Now, wait a second. If I am developing software package "A", and you develop competing package "B", and I find a hole in A and fix it, then just for laughs test to see if your product has the same hole and then I am kind enough to let you know that it does, then I announce that there is a hole in A, how am I responsible for the security of B at all? I've done you a favor by performing the test and giving you a heads up in the first place! I don't owe you anything.
I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.
You haven't given a specific example of Opera needlessly hiding an exploit.
I'm not sure what you think that has to do with anything. The Mozilla foundation didn't even announce to the public that there was a hole in Opera. The announcement is that there is a hole in Firefox. Why not try reading the advisory [mozilla.org]? There is NOTHING in there about Opera's susceptibility. You can't even view the bug report [mozilla.org] without a Mozilla bugzilla account with the proper access - I just logged into my account, and that doesn't include me, so it's not like even the report is generally available. Also, as per the advisory:
These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4, as well as an issue reported by hong which was fixed in Firefox 2.0.0.8.
So it seems as though the Opera team has had some warning about problems similar to these in the past - along with the rest of the world.
Could I find and fix a bug in one of my pieces of software in a day? Probably, because all of them are very simple. If I had a development team and a security response team (they do have one of those, don't they?) then I bet "I" could find and fix known security problems in larger software products in a day, too.
Actually, a number of security holes in the Linux kernel have been found, announced, and fixed on the same day, now that I think of it.
But never hiding bugs is silly. For example, if you provide an strace of ssh crashing, you'd want to mark that private at least.
Maybe, maybe not. You never know what the black hats already know; as a _user_ of ssh, if you disclose then I can take steps to limit damage--e.g. if I'm allowing full ssh access from outside my network (so that employees can work on the go), I may decide that the small benefit of doing so doesn't merit the risk. I'd rather turn off external ssh access for a few days until there's a fix.
When you hide the bug, you're hiding the ability for the users to take steps to protect themselves. You're forcing me to run with exposed systems for several days, and hoping that nobody "bad" knows about the bug. And you're making that judgement for your users rather than giving them the ability to make that call themselves; that's almost impossible given that the judgement might hinge heavily on whether I'm a large financial institute or a personal blog site that backs up daily. Just guessing that most users are happy with your security through obscurity is bound to be wrong in some cases, and those cases are likely to be some of the more financially significant ones.
(That's on top of the pressure to issue a real fix that full disclosure brings. Before things like BugTraq, it was common for people to sit on severe security bugs for literally _years_.)
When you hide the bug, you're hiding the ability for the users to take steps to protect themselves.
Yes, it's definitely a case of finding an equilibrium when being curteous in giving software developers around the world affected by the same vulnerability a reasonable time to adapt.
Unless for some reason they use the same engines, what's the problem with this practice? Opera's security isn't Firefox's responsibility. The fact that they notified opera at all went above and beyond what they needed to do, and asking firefox to be less open with their community is asking them to risk their image for the sake of opera and its users. Unless I'm missing something here, Firefox was being polite and Opera's throwing a world class hissy fit.
The problem usually isnt coding time. It's organizational response and resource allocation issues.
For example, Opera is on a very differen timezone from the US, so initial publication may happen overnight from the POV of the Opera staff.
So then a day starts. When people start their day, they have a pile of things to respond to. The incoming messsages have to be triaged. Someone has to make a decision that this is important enough to escalate or take action on.
Then you have to find people with the capability to test whether its a real problem. This may take a couple hours. People go on vacation, get sick, etc.
Then you have to take the time to do the research, test whether this is a real problem, what versions it affects, etc. This takes a couple hours.
Then yuou have to stop a coder from working on something else, bring them up to speed on the problem (if its not the same person doing the testing), and get them started on the fix.
Then even with a fix you have to do regression tests. Not sure about Opera, but many mature apps have full test suites that can take a couple hours.
Then you have to write release notes, update the web page, do a new deploy package, and update your update servers to notify Opera that there is a new update.
As you can see, very little of the time here is coding.
Many large orgs have taken steps to create a 'short path of decision making' to streamline this process, always have one coder on call who can do this work, etc. But even then if anything is out of whack or the wrong person is sick or on vacation or on another urgent item, a whole day could pass without response.
Yep, it sucks to be big. If the person that found the exploit logs on to IRC and posts it, instead of mailing the authors of the code, how much time do you think they have before a new trojan or malicious attack websites are setup. I'd make a guess it's under an hour. As the application developer you have to take what you're given. Your enemy is not going to give you any quarter. They are not going to wait around for you to patch your apps and distribute them. The ball is in the blackhats hand, all you can
As far as I can tell, Firefox had a flaw, they fixed it and notified Opera that they had the same flaw the day before Firefox's fix was announced. Sounds to me like the only thing that Firefox did wrong was notice that it affected Opera at all, because if they hadn't Opera would have been left with egg on their face and nothing to bitch about.
Clearly, the Mozilla team should be performing full regression testing on every bug they fix against every browser known to man. What if the bug affects NCSA Mosaic?
Hmm, there's something wrong with my sarcasmeter, it seems to be off the scale...
Clearly, the Mozilla team should be performing full regression testing on every bug they fix against every browser known to man.
I think the point is that they *did* know that this particular vulnerability affected Opera and took their time about telling them.
It still doesn't seem like a huge deal, but on the other hand if you read what the Opera guy actually wrote, it also doesn't seem like a huge deal. "Screeches" seems a bit excessive.
So mozilla should have left their users open to the big for longer, by delaying the fix so that Opera can catch up?
Or are you saying they should have released the fix and not mention what it was fixing - making it less likely people would apply the fix (plus it's open source not saying what it's fixing doesn't really keep it secret)?
Note that mozilla never mentioned Opera in the advisory anyway.
So what you're really saying is that Mozilla should pass all it's security fixes past Opera and IE and Safari and Konqueror and etc and not release them until all of those competitors have said "OK we've fixed it too".
You know, maybe I am blind, or perhaps just a little slow today, but I looked at the actual advisory (did you?) and I see no mention of the fact that the same bug impacted the Opera browser.
What I seem to get from the article is that a problem was found with Firefox, a fix was developed, and sometime prior to wrapping things up and deploying the fix, someone at Mozilla cared enough about the Internet environment we all share to do a quick regression test of Opera and when a problem was discovered, they PRIVATELY notified the Opera team.
What more could you ask for in the way of good citizenship?
Let's imagine that the Mozilla developers had modified the release notes for 2.0.0.12 so that it wasn't obvious what they'd fixed. Would that have been any better? Of course not. I can grab the code, diff against 2.0.0.11, take note of the changes, and presumably figure out why they were made. Now I can craft a working exploit against 2.0.0.11. After testing it on Firefox, what's the first thing I might try? How about... see if other browsers have the same problem?
So keeping in the fix but not mentioning it in the release notes is out. What, then... not patch the flaw? Yeah. Right.
Opera might be a nifty browser, but apparently its authors are whiny bitches.
Seems if they'd kept their whiny mouths shut, nobody would have realised from the vulnerability disclosure [mozilla.org] that the issue affects Opera. Now EVERYONE knows, from the kiddie scripting 'sploits to the IT manager planning the software deployment for the next few months, who is now seeing why closed-source Opera isn't really such a great choice after all. Even the CVE entry [mitre.org] doesn't disclose Opera's vulnerability to this bug. Still, it makes good comedy if nothing else...
Exactly. Not only does this story bring to light the fact that there's a bug in Opera, but it illustrates how Opera prefers to handle security bugs: by covering them up.
They've had twelve days to fix it. Have they? If you RTFA, you'll see not only have they not, they've expended a greater amount of energy trying to whip up support for their malcontent with Mozilla. So, in reply, yes it does seem that they would rather cover this up than fix the issue in a timely manner. Their actions scream it, even if TFA doesn't.
Mozilla fixed the flaw, along with other more serious bugs, with the release of Firefox 2.0.0.12 on 7 February. Opera, which is yet to plug the moderate risk flaw, objected to the Mozilla team publishing an advisory on the issue. Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory.
Opera was notified the day before the February 7 release - that would be February 6. Today is February 18. Is that not 12 days?
God's teeth, man! Have you really read the article? The vulnerability was reported to Opera a day before Fx 2.0.0.12 was released with full disclosure of Fx and Seamonkey bugs (no mention whatsoever of Opera) on the 7th. It is now the 18th. 18th - 6th = 12. Instead of keeping schtum and coding a fix, they chose to shoot themselves in the foot by disclosing that Opera had this vulnerability and it was the big, bad Mozilla Foundation's fault that it was disclo
Why is Mozilla obligated to wait and release an advisory because Opera couldn't get off their asses fast enough to respond to something. Also, opera users were already at risk and not just because of the advisory.
Offtopic: Did that opera guy ever swim from US to Norway? speak about obligations.
I know you don't have any people committed to different projects. I know you have your code at a stable point so its easy to slip in a change I know this only takes one guy 5 min to go change a few lines of code I know its ready to ship the moment its changed I know you coded it right and didn't break anything else
Remember this is open source. so you should be able to fix all security issues quickly. I bet someone else had already done it for you. Just ask someone for it.
Whats the point of being open source if you don't do what the community expects of you.
END RANT
OK, i bet the underlying issue is they expected to have a Little time. Emails went out to a few people that would look at and identify how big of an issue it was. Once they reported back, only the resources needed would be pulled off other projects to fix this.
The next day they see the advisory without warning and now they scramble to figure it out. Probably pulled a lot of people off other stuff that they didn't need to in order to rush out a minimally tested release.
Somebody posting to Slashdot says that somebody at The Register says that an Opera blogger screeches about Mozilla. Even for Slashdot, this is a pretty weak title.
What they actually say is that they only had a day between notification and public disclosure. He's actually happy that Mozilla told them at all (hence the:) ), but not happy that there was only a day before it was made public. Nobody is particularly happy when they only have a day from learning there's a security hole to everybody else learning about it, thats not enough time to get a fix rolled out, so this is hardly surprising.
I know Mozilla can do no wrong around here, but come on. Even the Mozilla devs would be happier getting more then one day before public disclosure of a security hole.
The security hole has been there for a long time. It didn't just appear in a puff of smoke when the Mozilla devs discovered it.
Not announcing it means that the black hats get to use it for longer, and that's bad for millions of users.
By contrast, delaying the announcement merely saves two or three develpers some embarrassment, at the cost of increased damage to everybody else.
However you look at it, the benefits of delayed announcements don't add up.
>Opera Screeches at Mozilla Over Security Disclosure
Common, can we get article titles and summaries that don't *immediately* tell us about how we should feel about an article before even telling us the circumstances?
I mean, give me a break, this is a lower standard of reporting than even fox news uses. For *once* I'd like to see a slashdot editor try to be objective, and let the reader make up our own mind instead of trying to spoon feed us our opinions.
I don't see how expressing dipleasure at something on a blog is an overreaction. "Screeching" is stretching it pretty fucking far, since it's basically saying what happened. Where in the blog entry is there screeching, perhaps the bold on "responsible", or maybe the ":("? Wouldn't it be better to link to the blog entry directly and not some dumb opinionated elreg article? Really, did you even read the original source before deciding "the developer needs a chill pill"?
At the end of the day, Mozilla would have acted better by keeping the exploits closed for a few more days, as they would hope anyone else would do for them. By not doing so, they upset people, and others expressing that upset is perfectly understandable. There's no mass outcry at Opera, no press release or open letter saying the Mozilla team are dicks, there's a few words saying what happened and a couple of emoticons on a developer blog entry.
All Things Considered... (Score:5, Insightful)
Re:All Things Considered... (Score:5, Insightful)
Parent
Re:All Things Considered... (Score:5, Insightful)
Parent
Re:All Things Considered... (Score:4, Insightful)
True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
Parent
Re:All Things Considered... (Score:4, Insightful)
True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
Parent
Re: (Score:3, Insightful)
But you've missed the point... (Score:5, Insightful)
No one is suggesting that Mozilla should have delayed the fix (in order to hold back disclosure).
No, it would have been open and responsible and good if someone at Mozilla had thought to send an email to the Opera dev team a week or two ago saying:
We're fixing this exploit and think you should too.
Lots of Love,
Your secret big red monster Valentine.
No need to coordinate releases, but given that it took them a while to patch it, they should assume it'll take Opera a wee while to, and in the meantime they're leaving members of the public open to exploit.
Members of the public that used to use Firefox, but had to stop because Mozilla never fixed the memory leak and these users were using old machines (NT4, 32 meg RAM) and Open Source was supposed to mean never being obsolete, but it was only the non-open, free Opera browser that offered me a fully-patched, fully working browser.
HAL.
Parent
Re:All Things Considered... (Score:5, Insightful)
Parent
Re:All Things Considered... (Score:5, Insightful)
The problem was reported in November and fixed in early February.
Clearly, this is longer than one day.
Following the links in other posts to the mozilla issue tracking, it apparently took a while to fix.
The Opera guys would have liked a little more heads-up than one day, that's all, and that doesn't seem unreasonable to me.
Why all the high-and-mighty whining about 'if they really cared they would have fixed it'?
Parent
Re:All Things Considered... (Score:5, Insightful)
Full public disclosure of security bugs is generally considered the best way to get rapid fixes, and was the entire reason that places like BugTraq were founded. Following standard protocol is not an "attack". Vendors like to assume that you're just maliciously publishing things that would be no problem for their users until you did so. That's untrue.
Many bugs are well-known by black hats before they are found by the good guys. The safest thing for users is to assume that all severe bugs are well-known by the bad guys; when you disclose publically, you give the users a chance to protect themselves even if the software is not yet fixed. I'm not sure of the details of this exploit, but they may be able to protect themselves by limiting their surfing to well-known trusted sites, using an alternate browser, or turning off javascript or whatever. In other cases, some sort of external wrapper or proxy, tighter firewall rules, limiting access to DMZs, or other external steps can help prevent big security problems even without a full vendor fix available yet. It may even be worth it to some users just to forgo using an application for a few days until it's fixed.
Keeping silent until the vendor fixes things might just hurt the user's security situation, and certainly doesn't give the user the option of evaluating the risk and determining whether it's worth ignoring it or not--it forces them to make their usage decision without good information.
Parent
Re: (Score:3, Insightful)
Further, why would you encourage others to "attack MS in this way?" - that is stupid and unprofessional. I am a committed Linux user, in my free time I build and test each kernel snapshot as it is released. Why, because I love to get into the guts of the system.
Am I a Windows lover? Not really, but I do bring up an XP image from time to time as a guest on my Linux s
Re:All Things Considered... (Score:4, Insightful)
Parent
First... (Score:5, Funny)
Oh bitch, bitch, bitch! (Score:3, Interesting)
Re: (Score:3, Funny)
Sheesh... (Score:3, Interesting)
I'm finding it a bit difficult to feel bad for Opera. Exactly how long does it take to "evaluate" a security issue, especially when someone else goes to the trouble of finding it in the first place, and then notifies you of the issue?
Opera had ample opportunity to roll out a fix...but they dragged their feet (as is their habit). This time, their habit got them burned. Perhaps next time they'll take a notification of a security issue more seriously.
Re:Sheesh... (Score:5, Informative)
Parent
Re:Sheesh... (Score:5, Insightful)
I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.
The fact that they hid the bug reports at all should be enough to make the Opera kids grateful. After all, the Mozilla foundation operates in a pretty open and transparent fashion. The most honest (and destructive) way to go would be to never hide the bug reports.
But just to cover that old ground once again; when code changes, diffs happen automatically, and people know just precisely what changed. You can be sure that some of those people are malicious hackers looking for new ways to screw us all; there's good money in it. So by hiding the details of the exploit, you make sure that only the more skillful and malicious hackers have the exploit. Does that sound like a good idea to you?
Parent
Re:Sheesh... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.
You haven't given a specific example of Opera needlessly hiding an exploit.
Re:Sheesh... (Score:5, Interesting)
Now, wait a second. If I am developing software package "A", and you develop competing package "B", and I find a hole in A and fix it, then just for laughs test to see if your product has the same hole and then I am kind enough to let you know that it does, then I announce that there is a hole in A, how am I responsible for the security of B at all? I've done you a favor by performing the test and giving you a heads up in the first place! I don't owe you anything.
I'm not sure what you think that has to do with anything. The Mozilla foundation didn't even announce to the public that there was a hole in Opera. The announcement is that there is a hole in Firefox. Why not try reading the advisory [mozilla.org]? There is NOTHING in there about Opera's susceptibility. You can't even view the bug report [mozilla.org] without a Mozilla bugzilla account with the proper access - I just logged into my account, and that doesn't include me, so it's not like even the report is generally available. Also, as per the advisory:
So it seems as though the Opera team has had some warning about problems similar to these in the past - along with the rest of the world.
Could I find and fix a bug in one of my pieces of software in a day? Probably, because all of them are very simple. If I had a development team and a security response team (they do have one of those, don't they?) then I bet "I" could find and fix known security problems in larger software products in a day, too.
Actually, a number of security holes in the Linux kernel have been found, announced, and fixed on the same day, now that I think of it.
Parent
Re:Sheesh... (Score:5, Insightful)
Maybe, maybe not. You never know what the black hats already know; as a _user_ of ssh, if you disclose then I can take steps to limit damage--e.g. if I'm allowing full ssh access from outside my network (so that employees can work on the go), I may decide that the small benefit of doing so doesn't merit the risk. I'd rather turn off external ssh access for a few days until there's a fix.
When you hide the bug, you're hiding the ability for the users to take steps to protect themselves. You're forcing me to run with exposed systems for several days, and hoping that nobody "bad" knows about the bug. And you're making that judgement for your users rather than giving them the ability to make that call themselves; that's almost impossible given that the judgement might hinge heavily on whether I'm a large financial institute or a personal blog site that backs up daily. Just guessing that most users are happy with your security through obscurity is bound to be wrong in some cases, and those cases are likely to be some of the more financially significant ones.
(That's on top of the pressure to issue a real fix that full disclosure brings. Before things like BugTraq, it was common for people to sit on severe security bugs for literally _years_.)
Parent
Re: (Score:3, Insightful)
Re:Sheesh... (Score:5, Insightful)
Parent
Re:Could a coder please weigh in? (Score:5, Insightful)
For example, Opera is on a very differen timezone from the US, so initial publication may happen overnight from the POV of the Opera staff.
So then a day starts. When people start their day, they have a pile of things to respond to. The incoming messsages have to be triaged. Someone has to make a decision that this is important enough to escalate or take action on.
Then you have to find people with the capability to test whether its a real problem. This may take a couple hours. People go on vacation, get sick, etc.
Then you have to take the time to do the research, test whether this is a real problem, what versions it affects, etc. This takes a couple hours.
Then yuou have to stop a coder from working on something else, bring them up to speed on the problem (if its not the same person doing the testing), and get them started on the fix.
Then even with a fix you have to do regression tests. Not sure about Opera, but many mature apps have full test suites that can take a couple hours.
Then you have to write release notes, update the web page, do a new deploy package, and update your update servers to notify Opera that there is a new update.
As you can see, very little of the time here is coding.
Many large orgs have taken steps to create a 'short path of decision making' to streamline this process, always have one coder on call who can do this work, etc. But even then if anything is out of whack or the wrong person is sick or on vacation or on another urgent item, a whole day could pass without response.
Parent
Re: (Score:3, Insightful)
I must be missing something here... (Score:5, Insightful)
Re:I must be missing something here... (Score:5, Funny)
Hmm, there's something wrong with my sarcasmeter, it seems to be off the scale...
Parent
Re: (Score:3, Funny)
Re:I must be missing something here... (Score:4, Insightful)
I think the point is that they *did* know that this particular vulnerability affected Opera and took their time about telling them.
It still doesn't seem like a huge deal, but on the other hand if you read what the Opera guy actually wrote, it also doesn't seem like a huge deal. "Screeches" seems a bit excessive.
Parent
Re: (Score:3, Funny)
Re:I must be missing something here... (Score:5, Insightful)
Or are you saying they should have released the fix and not mention what it was fixing - making it less likely people would apply the fix (plus it's open source not saying what it's fixing doesn't really keep it secret)?
Note that mozilla never mentioned Opera in the advisory anyway.
So what you're really saying is that Mozilla should pass all it's security fixes past Opera and IE and Safari and Konqueror and etc and not release them until all of those competitors have said "OK we've fixed it too".
Parent
Re:I must be missing something here... (Score:5, Insightful)
What I seem to get from the article is that a problem was found with Firefox, a fix was developed, and sometime prior to wrapping things up and deploying the fix, someone at Mozilla cared enough about the Internet environment we all share to do a quick regression test of Opera and when a problem was discovered, they PRIVATELY notified the Opera team.
What more could you ask for in the way of good citizenship?
Parent
See this? (Score:4, Funny)
the alternative being...? (Score:5, Insightful)
So keeping in the fix but not mentioning it in the release notes is out. What, then... not patch the flaw? Yeah. Right.
Opera might be a nifty browser, but apparently its authors are whiny bitches.
-=rsw
Apologies! (Score:4, Funny)
Next time we'll just let you figure it out on your own.
Streisand effect? (Score:5, Interesting)
Re: (Score:3, Insightful)
Re:insightful?? (Score:5, Interesting)
Parent
Re:insightful?? (Score:4, Informative)
From TFA:
Opera was notified the day before the February 7 release - that would be February 6. Today is February 18. Is that not 12 days?
Parent
Re: (Score:3, Informative)
God's teeth, man! Have you really read the article? The vulnerability was reported to Opera a day before Fx 2.0.0.12 was released with full disclosure of Fx and Seamonkey bugs (no mention whatsoever of Opera) on the 7th. It is now the 18th. 18th - 6th = 12. Instead of keeping schtum and coding a fix, they chose to shoot themselves in the foot by disclosing that Opera had this vulnerability and it was the big, bad Mozilla Foundation's fault that it was disclo
Oprah screeches at Godzilla over Security! (Score:5, Funny)
Was there an obigation? (Score:3)
Offtopic: Did that opera guy ever swim from US to Norway? speak about obligations.
Whats the big deal, just go fix it (Score:3, Interesting)
I know you don't have any people committed to different projects.
I know you have your code at a stable point so its easy to slip in a change
I know this only takes one guy 5 min to go change a few lines of code
I know its ready to ship the moment its changed
I know you coded it right and didn't break anything else
Remember this is open source. so you should be able to fix all security issues quickly. I bet someone else had already done it for you. Just ask someone for it.
Whats the point of being open source if you don't do what the community expects of you.
END RANT
OK, i bet the underlying issue is they expected to have a Little time. Emails went out to a few people that would look at and identify how big of an issue it was. Once they reported back, only the resources needed would be pulled off other projects to fix this.
The next day they see the advisory without warning and now they scramble to figure it out. Probably pulled a lot of people off other stuff that they didn't need to in order to rush out a minimally tested release.
...it places Opera users at unnecessary risk? (Score:4, Funny)
Crap article (Score:5, Insightful)
What they actually say is that they only had a day between notification and public disclosure. He's actually happy that Mozilla told them at all (hence the
I know Mozilla can do no wrong around here, but come on. Even the Mozilla devs would be happier getting more then one day before public disclosure of a security hole.
Re: (Score:3, Insightful)
Not announcing it means that the black hats get to use it for longer, and that's bad for millions of users. By contrast, delaying the announcement merely saves two or three develpers some embarrassment, at the cost of increased damage to everybody else.
However you look at it, the benefits of delayed announcements don't add up.
screeches? (Score:4, Insightful)
Common, can we get article titles and summaries that don't *immediately* tell us about how we should feel about an article before even telling us the circumstances?
I mean, give me a break, this is a lower standard of reporting than even fox news uses. For *once* I'd like to see a slashdot editor try to be objective, and let the reader make up our own mind instead of trying to spoon feed us our opinions.
Re:overreaction (Score:5, Interesting)
At the end of the day, Mozilla would have acted better by keeping the exploits closed for a few more days, as they would hope anyone else would do for them. By not doing so, they upset people, and others expressing that upset is perfectly understandable. There's no mass outcry at Opera, no press release or open letter saying the Mozilla team are dicks, there's a few words saying what happened and a couple of emoticons on a developer blog entry.
Parent
Re: (Score:3, Insightful)
So I took a look at the last story [slashdot.org] about Firefox bugs. And guess what - you have people criticising the person for making the bug public in a way not helpful to the developers [slashdot.org]. And do I hear "crybaby"? No, instead it gets modded up to +4.