Developer's Toolkit

Blog archive

Secrecy or Openness?

The recent controversy surrounding the presentation at the Black Hat Conference of security vulnerabilities in Cisco's Internetwork Operating System used in routers once again raises the question of whether the security of web sites, data, and networks are best served through the wide distribution of known security issues so that everyone is on an equal footing, or secrecy, until those vulnerabilities can be addressed by the responsible parties.

Good arguments can be made either way. By fostering and supporting open communication about vulnerabilities, we can ensure that the word gets out quickly and equitably to those who need to fix the problem or become more vigilant. And details of the problem reach both hackers and their potential victims equally, rather than just the hackers. Last, publicity of a vulnerability may encourage the vendor to address the problem more quickly.

But not all customers are created equal. Some, despite the best efforts, will never get the word, or will decide for whatever reasons to risk being less than secure for the sake of cost or skill or opportunity. They can find themselves at the mercy of a broad community of both hackers and general publicity-seekers, simply because the information was made public.

And a vendor's point of view is also reasonable and valid. Were I a decision-maker at Cisco, I would honestly believe that I should have an opportunity to make good before my customers fell before the onslaught of unscrupulous hackers. And there are no doubt legal minds who advise maintaining silence, lest the company be held liable before there is a chance for any action to be taken.

As a proponent of democratic principles, my instinct leans toward openness. Not only does little good come from keeping secrets, but secrets invariably get leaked. And leaks mean that those who are paying attention are likely to have an advantage over those who are not.

And while secrecy provides the opportunity for the vendor to address the problem, that is assuming that those responsible parties are, in fact, responsible. It is easy to believe that those companies who release software that is subsequently found to be vulnerable are really protecting their image, and of course their sales, rather than dropping everything to make the problem right. I personally have found myself in situations where I wanted to do the right thing for customers, only to find that others had drastically different interpretations of what the right thing was, and who the right thing was for.

Nevertheless, there does not seem to be any middle ground in this debate. Legally, there are a myriad of laws that appear to cover this issue, including liability and tort law, privacy law, trade secret and patent law, and freedom of speech. Freedom of speech may eventually triumph in a relatively free society, but the cost in money and time could be too high if a vendor such as Cisco seeks to apply one of the myriad of laws protecting its own interests.

In this great debate between transparency and secrecy in protecting our technology assets, we must still opt for the former. Society's ideal is openness rather than secrecy. Hardware and software providers may take the legally safe route, but that is a short-sighted attitude that does not well serve the business, the user community, or the society at large. It is possible to cite good and even compelling reasons for protecting such information, but they simply do not stand up against the principles by which we live.

Posted by Peter Varhol on 08/03/2005 at 1:15 PM


comments powered by Disqus

Featured

  • How to Do Machine Learning Evolutionary Optimization Using C#

    Resident data scientist Dr. James McCaffrey of Microsoft Research turns his attention to evolutionary optimization, using a full code download, screenshots and graphics to explain this machine learning technique used to train many types of models by modeling the biological processes of natural selection, evolution, and mutation.

  • Old Stone Wall Graphic

    Visual Studio Code Boosts Java Dependency Viewer

    Easier management of project code dependencies and improvements to extensions for popular Java frameworks and runtimes highlight the February update to Java in Visual Studio Code functionality.

  • Blule Squares

    Visual Studio 2019 for Mac 8.5 Preview Adds ASP.NET Core Authentication

    Microsoft, after shipping Visual Studio 2019 for Mac v8.4 with support for ASP.NET Core Blazor Server applications last month, is now previewing the v8.5 series, adding new authentication templates for ASP.NET Core along with other improvements.

  • Q&A with Brice Wilson: What's New in Angular 9

    We caught up with expert web developer/trainer Brice Wilson to get his take on Angular, which always appears at or near the top of periodic rankings of the most popular JavaScript-based web development frameworks.

  • Entity Framework Core Migrations

    Eric Vogel uses code samples and screenshots to demonstrate how to use Entity Framework Core migrations in a .NET Core application through the command line and in code.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events