I'm going to say something that's been festering in my mind for a while now. In my two decades of practice in information security, I have yet to see responsible disclosure result in measurably better security posture.

Code quality hasn't improved, patch management hasn't improved, minimum viable product hasn't improved, automated security updates, especially for IoT devices... ^{Jesus Fucking Christ} haven't improved. The cost of failure for organizations losing your data due to gross negligence has in no way improved, why should responsibility be the domain of the security researcher when nobody else is willing to share in that responsibility?

I'm half-tempted to say if you have 0-days you might as well get paid for them than be responsible. Because even with a tilted playing field, nothing has measurably improved since I've been here and I would argue with "vibe coding" and the tech industry's view of "Let the AI handle it" that software quality is the worst it has been since the 90s. I lived through windows millennium edition. I've seen shit you wouldn't believe.

"Hardware's fucked because we can't buy any, software is fucked because the LLMs trained by reddit and stack overflow are in charge now. You might as well fucking guess at this point."

I'm going to say something that's been festering in my mind for a while now. In my two decades of practice in information security, I have yet to see responsible disclosure result in measurably better security posture.

Code quality hasn't improved, patch management hasn't improved, minimum viable product hasn't improved, automated security updates, especially for IoT devices... ^{Jesus Fucking Christ} haven't improved. The cost of failure for organizations losing your data due to gross negligence has in no way improved, why should responsibility be the domain of the security researcher when nobody else is willing to share in that responsibility?

I'm half-tempted to say if you have 0-days you might as well get paid for them than be responsible. Because even with a tilted playing field, nothing has measurably improved since I've been here and I would argue with "vibe coding" and the tech industry's view of "Let the AI handle it" that software quality is the worst it has been since the 90s. I lived through windows millennium edition. I've seen shit you wouldn't believe.

"Hardware's fucked because we can't buy any, software is fucked because the LLMs trained by reddit and stack overflow are in charge now. You might as well fucking guess at this point."

nobody is held liable when breaches occur and your PII gets stolen for the fifth time in a single year.

And then we read the inevitable report that it was a third-party managed system that was 6 months behind in patches that got popped. Or it was a risk assessment result that they said "they would get to that eventually" and never did.

You start throwing executives in cuffs for failing to do their duty and sure as shit things would start changing.

It has always been the privilege of the corporations and the rich to define what responsibility is. I'm here to tell you don't give them what they aren't willing to give us.

It has always been the privilege of the corporations and the rich to define what responsibility is. I'm here to tell you don't give them what they aren't willing to give us.

@da_667 Welcome to the club!

Yes, the "responsible" disclosure was designed to push as much responsibility to whoever finds The Bug and absolve everyone else. It is an emotionally-charged term, and I think purposefully so. You are supposed to feel bad about *not* doing it or doing it in a way The Company disagrees with. I mean, think of the children^W^W^Wusers! And then when you, in your silliness, try to do the supposedly right thing, and get a legal threat back -- well, folks, that ain't kind of the responsibility I remember ever taking upon myself. If I get threats and violence for doing supposedly good, I ain't doing good no more, sorry. Not interested. Maybe someone else will, I don't care. So I say we treat vulnerability disclosure as proper journalism, according to Orwell: "Journalism is printing what someone else does not want published; everything else is public relations."

Yes, the select few have made a fortune on bug bounties or whatever, but the vast majority gets breadcrumbs and the feeling of Doing The Right Thing. That feeling is where they got us. Taking responsibility for someone else's fuck-ups and feeling guilty for not being responsible enough, that's so weird, man. I didn't put the bugs in there, you did, dear company, by hiring the cheapest contractors to do the job and firing the one person who actually cared. We all know how it goes. After all, nothing a company does is in the interest of the end user or anybody else but the company itself and/or the shareholders.

So yeah, got a 0-day? To full disclosure, or sell it off if that's your thing. At least remember you got a choice here.

Sorry for a bunch of words, the topic hits rather close here too.

I'm going to say something that's been festering in my mind for a while now. In my two decades of practice in information security, I have yet to see responsible disclosure result in measurably better security posture.

Code quality hasn't improved, patch management hasn't improved, minimum viable product hasn't improved, automated security updates, especially for IoT devices... ^{Jesus Fucking Christ} haven't improved. The cost of failure for organizations losing your data due to gross negligence has in no way improved, why should responsibility be the domain of the security researcher when nobody else is willing to share in that responsibility?

I'm half-tempted to say if you have 0-days you might as well get paid for them than be responsible. Because even with a tilted playing field, nothing has measurably improved since I've been here and I would argue with "vibe coding" and the tech industry's view of "Let the AI handle it" that software quality is the worst it has been since the 90s. I lived through windows millennium edition. I've seen shit you wouldn't believe.

"Hardware's fucked because we can't buy any, software is fucked because the LLMs trained by reddit and stack overflow are in charge now. You might as well fucking guess at this point."

@da_667 I started doing computer support professionally in 1985. By the end of the dot-com era in the early 2000's, I had long burned out on fighting the same battles endlessly in corporate IT. Things were never going to get better for the reasons you cite--basically coming down to a lack of real consequences for doing a bad job.

In addition, there are now entire industries that have grown up around offering "solutions" for how broken these practices and products are. And also industries around handling the blast effects from the latest successful intrusions. You can buy "cyber insurance" to give the appearance of managing your corporate risk. InfoSec has become "too big to fail".

After thinking about this long and hard, I ended up going into the incident response business. If security breaches are inevitable, IR services will always be in demand. I get paid better and get more respect from customers than I ever did trying to do things right the first time. I don't kid myself that our remediation strategies are likely to make a long-term difference in most organizations' security postures, but sometimes there's a win.

@da_667 I started doing computer support professionally in 1985. By the end of the dot-com era in the early 2000's, I had long burned out on fighting the same battles endlessly in corporate IT. Things were never going to get better for the reasons you cite--basically coming down to a lack of real consequences for doing a bad job.

In addition, there are now entire industries that have grown up around offering "solutions" for how broken these practices and products are. And also industries around handling the blast effects from the latest successful intrusions. You can buy "cyber insurance" to give the appearance of managing your corporate risk. InfoSec has become "too big to fail".

After thinking about this long and hard, I ended up going into the incident response business. If security breaches are inevitable, IR services will always be in demand. I get paid better and get more respect from customers than I ever did trying to do things right the first time. I don't kid myself that our remediation strategies are likely to make a long-term difference in most organizations' security postures, but sometimes there's a win.

nobody is held liable when breaches occur and your PII gets stolen for the fifth time in a single year.

And then we read the inevitable report that it was a third-party managed system that was 6 months behind in patches that got popped. Or it was a risk assessment result that they said "they would get to that eventually" and never did.

You start throwing executives in cuffs for failing to do their duty and sure as shit things would start changing.