[wp-hackers] List etiquette

[Roy Schestowitz]

___/ On Thu 20 Apr 2006 20:33:17 BST, [ Matt Mullenweg ] wrote : \___

> Elliotte Harold wrote:
>> I disagree. Security by obscurity is at best 1 out of 2. Because you 
>> posted the proof of concept I was able to analyze it, understand it, 
>> and figure out how to protect myself against the attack despite a 
>> huge amount of misinformation that continues to be thrown around on 
>> this list. If you hadn't posted the proof of concept, I still 
>> wouldn't understand exactly what the problem is or how to prevent it.
>
> Yes, but the main responsibility of developers is not to Elliotte 
> Harold. Your selfish interests do not coincide with the WP community.


I think this reply is a bit harsh (phrasing that was chosen in haste is
probable), but I tend to agree with the general idea. Protecting oneself
based on a description is something that only a puny userbase cares for, to
say the least.


> I also missed your patch on Trac.
>
> Publishing line-by-line exploits or details about security 
> vulnerabilities when we do a release would help crackers far more 
> than our general user base, which is overwhelmingly non-technical. We 
> get flak about it, but frankly I care far more about our non-savvy 
> and more vulnerable users than security-blinded idealists.


People aspire to get some merit for discovering bugs and reporting them. By
making reports non-public and offering no bounty, you are likely to deter
the required behaviour. Look at them vulnerabilities that are auctioned in
eBay. I am not suggesting that Autommatic should reveal its pocket.


> This is not "security by obscurity," our source code, SVN diffs, and 
> Trac tickets are entirely public, it's just common sense of trying to 
> help your users more than script kiddies.


Security can also be attained by excess and 'noise'. Trac would be hard to
follow and script kiddies won't bother.


> Firefox has a very similar approach.


It does, but let's not pretend that WordPress is on par with Firefox, or
even Apache (pertaining to a previous discussion/rant sparked by Skippy).

Best wishes,

Roy

-- 
Roy S. Schestowitz
http://Schestowitz.com  |    SuSE Linux    ¦     PGP-Key: 0x74572E8E
  1:10am  up 43 days 14:53,  6 users,  load average: 0.30, 0.61, 0.72