36

A question has been asked on the Drupal Answers Meta:

better tools for dealing with questions that disclose security issues

The OP is essentially asking that there should be some sort of mechanism for posts to be deleted/removed from the site, based on the premise that they might (perhaps unintentionally) expose a potential security flaw inside Drupal or one of its modules, that hasn't yet been discovered by the security team.

One of the moderators of the site has actually offered to perform these deletions on the OP's behalf if it is reported to him (through whatever channel that might be; I'm led to believe it's IRC but I guess that's irrelevant). This has obviously all been done in good faith, and from the point of view of Drupal.org this clearly makes sense.

It makes me kind of uncomfortable, though, as it doesn't seem like that's a valid reason to delete a post from a Stack Exchange site; it also seems wrong that any external entity should have this sort of influence over an SE site without it having been agreed at a higher level first.

Am I right to feel uncomfortable or am I just getting my knickers in a twist over nothing?

Improve this question
7
  • 8
    No offense to the poster of that meta post, but so not our problem. People on Stack Overflow have pointed out bugs in .NET and Eric Lippert was the first to acknowledge that they were bugs.
    – casperOne
    Commented May 2, 2012 at 13:34
  • 1
    @casperOne Funnily enough I've seen Eric acknowledging bugs (and even thanking the OP for the report) before, and that's exactly the reason I asked this question.
    – Clive
    Commented May 2, 2012 at 13:42
  • 1
    The two comments here make it sound like I'm trying to ignore bugs (i.e. not acknowledge) or that I'm not thankful for people reporting them. Quite the opposite, of course. I am thankful, but want to channel them into the most helpful/productive place. @Clive - let's discuss on that issue whether this is an appropriate way to use drupal.SE or not. If the drupal.SE community agrees one way or another then I think that helps resolve this, right?
    – greggles
    Commented May 2, 2012 at 17:09
  • 1
    @greggles Sincere apologies, I didn't mean to imply that at all; I'm aware of the work you do in the Drupal community and have huge respect for it. I only asked this here as from experience the general rules for one SE site apply to all SE sites...I was just trying to get clarification on the general issue of deleting questions for the reason of exposing security vulnerabilities. You're right though, let's take this back to drupal.SE
    – Clive
    Commented May 2, 2012 at 17:18
  • 1
    I should also say: I'm glad this is being discussed as a general question. It's not something I considered when the drupal.SE site was proposed and while I'm not sure the answer would have affected my feelings (of loving it) it could be more important to other groups.
    – greggles
    Commented May 2, 2012 at 17:22
  • 3
    Yeah, Open Source projects are always way less secure for this reason, just look at FreeBSD amirite? But seriously, finding security holes is how they're fixed. That's why active Open Source projects are usually a lot more secure simply because a lot more people are poking at the wholes and working to fix them.
    – Zelda
    Commented May 3, 2012 at 14:08
  • Here is a non-Drupal example, BTW: stackoverflow.com/posts/9472603/revisions
    – Yuhong Bao
    Commented Jun 16, 2012 at 5:42

4 Answers 4

Reset to default
19

This is a decision the community on Drupal.SE has to make, and the moderators there are part of that community. It's up to the community to decide which policy they want to follow with regard to disclosure of security vulnerabilities.

I haven't seen any interference here from external sources, though the communities of Drupal.SE and Drupal.org obviously overlap significantly.

The disclosure of vulnerabilities doesn't only affect Drupal.org, but all Drupal users. You can certainly debate whether full disclosure or responsible disclosure are the right choice, but this is definitely an issue that affects the whole Drupal community.

I'll add that I expect that if the community decides to go this way, it won't compromise the ability to help those users asking the questions. Deleting questions isn't meant for the purpose of separating security-relevant posts, e.g. you can't reply to the user asking the question anymore after deleting it. There needs to be some feedback, showing the user that the Drupal security team is aware of the issue and explaining the user how to proceed according further.

Improve this answer
12

As a security professional with over 16 years in the field, and in my role as Chairman of the Scottish branch of the Institute of Information Security Professionals and the President of ISACA Scotland, as well as being one of the moderators over on our very own Security Stack Exchange, I thought I should provide a bit of information as to why Responsible Disclosure is considered essential:

First up, a description of Responsible Disclosure (this one from Dell SecureWorks)

Notifying a vendor prior to releasing information publicly about a vulnerability is standard practice in the security industry and is known as “responsible disclosure.” This advance notice allows vendors to research and fix vulnerabilities before computer criminals are notified of their existence – keeping the internet safer for business.

Admittedly, some vendors are better than others, but generally if you find a vulnerability in a product, and inform the vendor, they will plan a fix and incorporate it into a later version. There are varying timelines for this, some may take months, some may do it very quickly - faster if it is a critical issue - but giving them the chance to fix it helps all their customers.

If you publish a new vulnerability without giving the vendor time to prepare a fix, an attacker will have an exploit ready incredibly quickly (we see turnaround times in days, or even hours) whereas vendors will have to go through validation, testing, management and rollout to customers.

So you may indirectly cause a large number of people to be attacked - in this case I'm not sure what the worst case scenario would be, but the usual targets include getting bank logins from people's computers.

Would you like to cause the people who use this code to be at risk? Or would you rather defer publication for a month or two and work with the vendor to let them fix the problem?

The actual length of time you wait is a difficult one - some vendors have been known to need a bit of hurrying up, but as noted security expert Bruce Schneier points out, the threat of Full Disclosure does work!

Over on Security Stack Exchange we have this question on how to disclose security vulnerabilities in an ethical fashion.

Improve this answer
3
  • 1
    So if there is a process established to remove the disclosing question, there also needs to be a mechanism to re-open it after some time, even if it is not yet fixed.
    – Ladybug Killer
    Commented May 3, 2012 at 9:40
  • 4
    @LadybugKiller Feature request! make a question "private" (mod-only), not deleted. Would be easier to set to reopen... perhaps the "private question" feature could even automatically timeout after X days...
    – AviD
    Commented May 3, 2012 at 9:45
  • Thanks, Rory and Ladybug Killer. This is all I'm asking, is for Stack Overflow to deal with security issues the way that is most common among security researchers from around the world. By the way, the question that sparked this discussion has been republished following this release drupal.org/node/1557938 - the Drupal.SE question was unpublished for just a few days.
    – greggles
    Commented May 3, 2012 at 14:21
9

I agree with Fabian that it is a community decision, but I disagree on which community is the focus here. While being a part of the Drupal community, the Stack Exchange site exists because the people there believe that the way of doing things here is better than other options for Q&A that currently exist.

That said, I believe that the greater obligation is to the Stack Exchange network first. To that end, if the question meets the standards for a question on the Stack Exchange network (and the site in particular), then there should be no reason it's deleted.

And let's not forget that just because it's not posted here, it won't be posted somewhere else. Imagine if it got to Reddit?

Because of that, it's actually a good thing that these things are brought out in the open; it increases the pressure to fix the holes, as going around trying to take down information from well-established sites is a fool's errand.

If a third party can't/doesn't know how to fix a bug and a solution is posted on a Stack Exchange site, then it's actually doing a disservice to that community by deleting the question and solutions to it.

We throw around the tagline "improving the Internet" a great deal here, but this is one of those cases where I feel it truly applies; removing this information serves no one, you're just perpetuating a game of whack-a-mole, while not encouraging the addressing of the real problem, which is the fix of the software at hand.

Improve this answer
26
  • 3
    The Drupal Security Team takes a pretty standard approach on this compared to other software vendors. Compared to other open source communities we tend to be far more open about what is a bug and what isn't. Is your feeling that Full Disclosure is always the right thing for all software? Our goal is not to hide bugs forever, but to coordinate the announcement of the problem with the availability of a solution.
    – greggles
    Commented May 2, 2012 at 17:01
  • 4
    @greggles Your approach is your own, but that in no way entitles you to dictate what is and is not able to be posted on our family of sites. This question isn't about other software, but about whether or not Stack Exchange should restrict information because of the policies of other sites/entities (namely you). With the exception of copyright issues (which you have to issue a takedown notice for), the content provided on the Stack Exchange sites is subject to our guidelines, not yours.
    – casperOne
    Commented May 2, 2012 at 17:21
  • Of course I agree with that statement, casperOne. Content here (or on any other site, as you so accurately point out) is the responsibility and property of that site. Can you respond about whether you think Full Disclosure is always the right solution for all software? Or for all Open Source software?
    – greggles
    Commented May 2, 2012 at 17:35
  • @greggles Of course I could, but I won't as that's not the topic at hand. It's not relevant to this particular post.
    – casperOne
    Commented May 2, 2012 at 17:36
  • 2
    If you don't believe in Full Disclosure for all software, or at least all open source software, then I just don't get the extreme nature of your answer that it's a virtue of SE to highlight security bugs like this. BTW, I found a security issue in BlogEngine.net - what's the proper way to handle it?
    – greggles
    Commented May 2, 2012 at 17:51
  • 1
    SE has given the existing communites quite a bit of room to develop their own culture and rules, even when they disagreed with those decisions (see the [soft-question] or [big-list]-tagged questions on Math.SE as an example). There are a few basic rules that all sites have to follow, but I don't see any need to enforce more rules from the top. I think that most decisions should be made on a site-level, but they certainly should take the network-wide rules as guidelines.
    – Mad Scientist
    Commented May 2, 2012 at 18:00
  • 4
    @Fabian I don't disagree that existing communities are (and should be) given quite a bit of room to develop their own culture and rules; however, what's being asked borders on censorship, IMO. This sets an extremely dangerous precedent for all of the Stack Exchange sites and flies in the face of "making the Internet better."
    – casperOne
    Commented May 2, 2012 at 18:03
  • 1
    @casperOne I didn't say you had been offensive and I don't think I've been not-nice. I said your answer felt extreme. I'm not trying to derail the topic by mentioning BlogEngine.net, I am trying to understand your answer. Knowing how you feel about this issue as it relates to software in general or a platform you use seemed like a way I could better understand your answer. I apologize if that felt not-nice, certainly not my intent.
    – greggles
    Commented May 2, 2012 at 18:14
  • 1
    @greggles No offense taken. I'm sure you can understand how allowing creep into the conversation can be non constructive. It's not so much I have a feeling about open-source software or any other software. What I'm projecting (and fiercely) is someone basically coming into our house and trying to tell us what to do. I get that you might not have had those intentions, but we (the community, not just SE or the moderators) work very hard to maintain a resource that lives up to an ideal.
    – casperOne
    Commented May 2, 2012 at 18:17
  • 1
    @greggles That said, if the response comes off too strong, I apologize, it's just that the precedent that this could set could extend way beyond Drupal.SE to all of the Stack Exchange sites, and that could be very, very bad (from our point of view, of course).
    – casperOne
    Commented May 2, 2012 at 18:18
  • 3
    @casperOne - please have a look at my answer. This is a major issue in the security community, and it goes much wider than demands. It is about doing the right thing, and not exposing users to unnecessary risk.
    – Rory Alsop
    Commented May 3, 2012 at 9:05
  • 3
    @RoryAlsop As a moderator, my primary, greater concern and obligation is to the Stack Exchange communities, not the security or the Drupal communities.
    – casperOne
    Commented May 3, 2012 at 18:25
  • 1
    @AviD I'm not a doctor, and the terms that I agreed to did not include primum non nocere, or the Hippocratic oath, for that matter.
    – casperOne
    Commented May 4, 2012 at 12:46
  • 1
    @AviD Maybe it is, maybe it's not, but in order to make the Internet a better place, we have to make sure our own house is in order. Hence limiting the discussion to Stack Exchange first, and the rest of the Internet second.
    – casperOne
    Commented May 4, 2012 at 13:50
  • 1
    Hmm - I think there is a distinct difference between responsible disclosure and reacting to someone demanding a particular post be deleted for security reasons.
    – Rory Alsop
    Commented May 4, 2012 at 14:16
2

If deleted questions can be undeleted, and if a question is deleted because it discloses an unpatched vulnerability, and if the deleted question is undeleted once the vulnerability is either patched or disclosed elsewhere then i think this is a reasonable and responsible policy.

Improve this answer
5
  • 2
    Don't forget: once deleted by a moderator, a question can only be undeleted by another (or the same) moderator.
    – Nicol Bolas
    Commented May 2, 2012 at 10:49
  • 1
    Moderators are also the only ones who see every deleted questions without having a direct link to the question, or who can search for deleted posts using "deleted:1" as search term.
    – avpaderno
    Commented May 2, 2012 at 11:05
  • What about questions that are deleted after a data dump? Or are still queryable by SEDE...
    – davidsleeps
    Commented May 2, 2012 at 11:58
  • 1
    @davidsleeps Questions that are deleted after they have been included in a data dump are still query-able.
    – avpaderno
    Commented May 2, 2012 at 14:16
  • @kiamlaluno exactly my point...
    – davidsleeps
    Commented May 3, 2012 at 3:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .