First, thanks for the careful response. You and I argue in much the same manner as pure sodium argues with water. You're being nicer than I am this time.
Second, the point of posting a catalog of vulnerabilities encrypted under the RSA keys of vendor SSL certificates is that the vendor can authenticate a posting; the vendor, after all, is the only party that can decrypt them. I think we're clear on who the actors are here.
You appear to be trying to build a system that exerts pressure on vendors to fix and publish security findings by allowing researchers to safely claim publicly that they have findings.
But researchers already have several tools for doing this. One of those tools (my least favorite) is things like the ZDI, where you are paid hundreds or thousands of dollars to let a big company handle the problem for you. Another popular solution that has the virtue of simplicity is, again, simply posting a SHA-1 hash of your finding, like, "ad1ad1ccb6da145406edef884e0595b4b1f5c4ae IE8".
The latter solution is exactly as amenable to pressuring vendors as "vulnarb.com" is. You can even help. Just collect and aggregate those reports. No public key cleverness is required.
My read on you --- and please take this as a compliment --- is that you are a cleverness junkie. The trick of sending encrypted messages using SSL certs instead PGP or S/MIME is indeed clever. But not every clever solution serves a real problem.
Yep, you know way more about this than I do. I've wanted to solve this problem for a while so any feedback helps.
The only thing you seem to be missing in the above is the consumers. It's not about getting the vulnerabilities transmitted to them, it's about posting that they exist, who did them, how severe they are, and in a way that can be verified by all three parties.
AFAIK, I can't currently go do that with ZDI right? They're sort of paid to keep this secret.
As for gathering existing SHA1 hashes, I'll look into that. Could be a way to seed the database ahead of time.
And no, I'm not a cleverness junkie. I mean, it's a shell script that's like 8 lines long. I just saw a problem in getting a vendor's "public key" and then realized I could do it this way.
How does this SHA-1 hash come full circle? Everybody on the web will know that I hashed something. The vender knows that I hashed the findings I sent to them, but so what? Do I have to post the hash on my own domain, so the vender knows that the findings they received are from the same person who owns the domain where the hash was posted?
Subtracting "reputation" as a requirement in that equation has to have at least a small positive value, doesn't it? I don't know how many independent researchers there are who have a chicken-and-egg problem with reputation because they don't know how to disclose both visibly and responsibly. But if there are any, Zed's method seems beneficial.
I think point of hashing is to prove that researcher has indeed found the vulnerability first and reported it to the vendor. It is proof for "this summary was written by me 2 months ago".
Hash must be posted to some archived/public place (tweet, mailing list, etc) that can be referenced at later date when actual summary is released.
I should have been clearer. Researchers post SHA-1 hashes publicly (if they care). They send the actual details directly to the vendor. The vendors you care about publish PGP keys. The ones who don't can't really be trusted to handle security advisories anyways. No, really: they really do put them in their public bug databases!
What made the vulnarb.com idea interesting is that by combining the two actions: a safe public notice and a secure vendor communiation --- you could create a public clearinghouse that consumers can consult to see if (say) Google is holding back on disclosures.
The issue here is, you don't need an elaborate crypto scheme to do this. Tavis Ormandy doesn't have to post an encrypted bundle anywhere to notify the public that he has a new Microsoft bug. He can just say "I have a new Microsoft bug" on Twitter. Reputation is so compelling that really, nobody bothers even posting SHA-1 hashes anymore. If you work for a credible vuln research shop and you post a message saying you have a finding in Adobe Reader, you have it. Case closed.
Zed could build the aggregator for these reports if he wanted to. It would be valuable. But that's just data entry. Zed programs. I don't blame him. I program too. I wouldn't want to build that site either.
> Tavis Ormandy ... can just say "I have a new Microsoft bug" on Twitter.
You're right, but what about the nobodies that haven't built up a personal trophy case of exploitable bugs? vulnarb.com may be solving a problem that doesn't exist for people that are already at the top of the vulnerability researcher club, but as with any group of people, there are hundreds if not thousands of people that aren't known and don't care to be the "l33t" ones giving conference talks and swapping private keys with Schneier and Knuth.
This could be a gateway for those people, college students and unknown hackers from non-first world countries (the alleged comodo hacker types for instance), to responsibly and legitimately get into the field. If marketed right, vulnarb.com could be a perfect way to post these notices, without getting trolled to oblivion on F-D.
Sorry I deleted my comment just as you posted. Thanks for the explanation.
Here is the deleted comment:
How does a vendor go from said SHA-1 hash to what the vulnerability is?
I saw this as a rough draft for a way to easily publish vulnerabilities without letting the public view them but still letting the vendor have all the information.
Second, the point of posting a catalog of vulnerabilities encrypted under the RSA keys of vendor SSL certificates is that the vendor can authenticate a posting; the vendor, after all, is the only party that can decrypt them. I think we're clear on who the actors are here.
You appear to be trying to build a system that exerts pressure on vendors to fix and publish security findings by allowing researchers to safely claim publicly that they have findings.
But researchers already have several tools for doing this. One of those tools (my least favorite) is things like the ZDI, where you are paid hundreds or thousands of dollars to let a big company handle the problem for you. Another popular solution that has the virtue of simplicity is, again, simply posting a SHA-1 hash of your finding, like, "ad1ad1ccb6da145406edef884e0595b4b1f5c4ae IE8".
The latter solution is exactly as amenable to pressuring vendors as "vulnarb.com" is. You can even help. Just collect and aggregate those reports. No public key cleverness is required.
My read on you --- and please take this as a compliment --- is that you are a cleverness junkie. The trick of sending encrypted messages using SSL certs instead PGP or S/MIME is indeed clever. But not every clever solution serves a real problem.