Top all-time · #14199
Thomas H. Ptacek
Personal blog · flaked.sockpuppet.orgsecurityprogramming
Thomas H. Ptacek's personal blog at flaked.sockpuppet.org covers security and programming. Since 2018, 5 different Hacker News readers have linked it 8 times, most often “A unified timeline of Efail disclosure events”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers cite this blog as a source on vulnerability disclosure, including embargo breaks, the Efail disclosure timeline, and reporting norms for internally found bugs such as Google+.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- A unified timeline of Efail disclosure events3 people · 3 mentions · first linked 2018-05-17
- Internal Disclosure Boring2 people · 3 mentions · first linked 2018-10-10
What Hacker News says?
The KRACK embargo expired as per agreement but I'll partially concede after reading about this OpenSSL accident: https://www.tedunangst.com/flak/post/regarding-embargoes Google broke an embargo early. https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... EFail embargo was broken. See https://twitter.com/seecurity/status/995964977461776385 and http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.h...…
Comment linking /2018/05/16/a-unified-timeline.html
on “Disable SMT/Hyperthreading in all Intel BIOSes”Submitted MEGA Attack Explainer as a story · 83 points
HN discussionAgain, this is poor reporting. It's newsworthy that Google+ found and disclosed a vulnerability in its own code, but there is no norm for reporting internally-discovered vulnerabilities and few companies reliably do it, especially in SAAS platforms where there's no end-user patching activity that needs to be motivated. There's a colorable argument that you don't even want this to be a norm, because of the incentive…
Comment linking /2018/10/09/internal-disclosure-boring.html
on “Google will shut down Google+ four months early after second data leak”Submitted You Need Deli Cups as a story · 23 points
HN discussionWhat an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden. It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties. Tens of thousands are found every year by internal teams and contractors at companies around the country, many of them far more severe than the G+ bug (wh…
Comment linking /2018/10/09/internal-disclosure-boring.html
on “US senator urges investigation into Google+ bug ‘coverup’”Submitted Internal Disclosure Boring as a story · 3 points
HN discussionI have no idea what you're trying to say here. If GnuPG's handling of this incident is a "red herring", you certainly haven't explained how. Here, again, is the timeline of what actually happened during the Efail disclosure process: http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.h... "Partial disclosures" are problematic because people guess vulnerabilities from clues in the disclosure. But that's not wh…
Comment linking /2018/05/16/a-unified-timeline.html
on “Attacking end-to-end email encryption [video]”Submitted A unified timeline of Efail disclosure events as a story · 1 points
HN discussion
