Oh, Look At That: Cisco Says There's A Big Flaw In IOS
from the hmm dept
Wait, wasn't there a big mess a few months back when a security researcher tried to let people know that Cisco's IOS was insecure and had vulnerabilities that could cause all sorts of problems to the internet? So, here we are a bit later on and what does Cisco do? They're suddenly saying that, oh yeah, IOS appears to have a major flaw that could cause all sorts of problems to the internet. Now, exactly what was wrong with letting people know that this was an issue two months ago?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
No Subject Given
[ link to this | view in chronology ]
Re: No Subject Given
[ link to this | view in chronology ]
No Subject Given
if it takes 6 months to come up with a fix for some problem then whats the point in announcing it until the the fix is available. as long as few ppl as possible know about the flaw then its less of an issue. its only when the flaw becomes widely publicised that it becomes a problem
[ link to this | view in chronology ]
Re: No Subject Given
1) YES, it DOES take time to fix a problem...but keeping admins in the dark UNTIL a fix is available means simply this:
- the people who COULD try and take steps to protect themselves are in the dark and unaware, the ONLY people who are aware are the company itself and the hackers who would take advantage of the situation.
and:
2) it has been proven time and again that without public revelation of these problems, fixes are either much longer in coming, lower in priority or not forthcoming AT ALL. No bad PR = no incentive to invest money and resources to fix problems.
The companies who push for "responsible vulnerability disclosure" the most are usually the ones who have consistently resisted and rebuffed attempts to inform them of problems.
[ link to this | view in chronology ]
Re: No Subject Given
But 'Responsible Vulnerability Disclosure' is what is needed. Unfortunately 'Responsible Vulnerability Disclosure' is often an euphemism for 'Security Through Obscurity' in fact, if not in marketspeak.
Is it responsible to prevent people from mediating the threat through some other action alternate to patches from the manufacturer?
Is it responsible to believe that what one researcher discovers no others will?
Is it responsible to trust to a bureaucratic corporate structure to fix a vulnerability without further external prompting?
So when a researcher discovers a vulnerability he is implicitly responsible for seeing it mended. First through addressing it with the manufacturer with full disclosure of the facts and extent of the vulnerability. Then by allowing a reasonable time to elapse for the manufacturer to repair and announce, with proper attribution as to discovery, the vulnerability. Finally, failing a reasonable manufacturer response the responsible thing to do is to announce the existence of the exploit to enable users to protect themselves and force action from the manufacturer.
Because is it really responsible to base your security on the stupidity of hackers?
[ link to this | view in chronology ]
huh!
-TC
[ link to this | view in chronology ]
Re: huh!
[ link to this | view in chronology ]
Cisco flaw
[ link to this | view in chronology ]
Full Disclosure
[ link to this | view in chronology ]