Home » Data Protection » Application Security

Opinion

FUD Watch | Good and Bad in the 'Security Researcher Circus'

Bill Brenner says Linux kernel creator Linus Torvalds is understandably annoyed with the circus atmosphere of vulnerability disclosure. But flaw finders deserve some credit for bringing order to the process.

By Bill Brenner, Senior Editor

August 20, 2008 — CSO —

Linux kernel creator Linus Torvalds' frustration over the "security circus" surrounding software vulnerabilities is understandable, but not entirely on the mark.

Bill Brenner

In an online rant last month, Torvalds wrote that "one reason I refuse to bother with the whole security circus is that I think it glorifies -- and thus encourages -- the wrong behavior. It makes 'heroes' out of security people, as if the people who don't just fix normal bugs aren't as important. In fact, all the boring normal bugs are way more important, just because there's a lot more of them."

I've long believed a lot of useless noise surrounds the flaw disclosure culture and that the findings very rarely meet doomsday expectations. In fact, the hype often distracts people from much bigger security problems. And there's no doubt the security research community has become something of a club, especially since the explosion of online social networking.

Go to a conference like Black Hat and the atmosphere resembles a club reunion. A lot of researchers are like rock stars. Many of them blog and can be found all over LinkedIn. Reporters love to be around them, including me. I missed Black Hat this year and admittedly felt a little left out.

Sometimes there's infighting over whether somebody is too slow or too eager to make a discovery public. When one researcher finds a big flaw, everyone wants to play with it and cook up their own exploit code, as the recent DNS saga clearly demonstrates.

Meanwhile, I've chatted with many a security administrator who failed to understand the media hype that often swirls around the latest big flaw. As one trusted source told me, such hoopla can blind people to a much bigger problem -- company networks that are so carelessly configured and maintained that attackers can drive a virtual truck through them without anyone noticing.

But there's a middle ground to be had here.

I talk to researchers on a regular basis and they are, for the most part, good people who want to handle their findings responsibly and be part of the solution rather than the problem. Their findings usually force the affected vendors to develop a patch and write more secure code in future versions of their product. It doesn't always work out that way, but it's usually the greater goal. The disclosure process is also a lot more civil than it once was, largely because vulnerability research has become a booming industry in itself.