Microsoft's stance on zero day exploits is a dumpster fire of their own making

75 points
1/21/1970
2 days ago
by _tk_

Comments


JumpCrisscross

> Hang on.. proof of concept exploit creation and distribution for zero days is “criminal activity” now?

Publicly publishing an exploit is so obviously First Amendment-protected activity that it’s almost tempting to want a test case.

2 days ago

avaer

It's also quite the blame gymnastics. The code that enables the bad actors was written, published, and distributed at massive scale by Microsoft. The "crime" they are accusing the researcher of is telling the world about it.

It would be an interesting case if the defendant had good representation.

2 days ago

bigfatkitten

I’d love to see Microsoft try it on. The defence witnesses in any such trial are going to show up holding all kinds of receipts that Microsoft would prefer didn’t see the light of day.

2 days ago

gremlinunderway

Re-read the beginning of the First Amendment, because it's such a common mistake that I'm surprised people still make it:

"Congress shall make no laws ... "

The first amendment bars the *government* from infringing on your free speech. It has zero standing or bearing on private citizens or corporations.

Which is why people crowing about it on social media or universities are completely oblivious to the fact that these organizations have absolutely zero responsibility to enable your free speech.

2 days ago

avaer

Microsoft's blog is calling this criminal activity. They are threatening to bring in the government to go after this speech.

This is a first amendment issue.

a day ago

1970-01-01

Straight to jail for you, citizen. Distribution of 0day for lulz has been criminal since 2022. You're free to try and get away with it under any and all amendments. IANAL!

https://krebsonsecurity.com/2022/06/what-counts-as-good-fait...

2 days ago

JumpCrisscross

> Distribution of 0day for lulz has been criminal since 2022

Skimmed the article. Not seeing it support your claim.

2 days ago

1970-01-01

Responsible disclosure is a normalized process in the courts. Skipping it opens you to, at very minimum, a plethora of civil lawsuits, including any and all the damages that resulted from skipping it. The odds are very much not great that you'll be OK.

2 days ago

JumpCrisscross

Civil, sure. The dispute is over criminal jurisdiction.

a day ago

dghlsakjg

Is there actually a civil duty of care here?

Responsible disclosure is an industry norm, but I don't really see how an independent researcher has a legal obligation to play by industry norms. If I discover that any product has a defect, I am free to blab about it all I want as long as it is truthful. There may be considerations beyond this if you are disclosing something discovered by breaking terms of service or by fucking with a computer that isn't yours, but discovering that your copy of windows on your machine has a flaw and telling people about it is protected.

a day ago

1970-01-01

Yes. Simply publishing on GitHub makes it's a TOS violation. You're free to blab all you want. Just host it on your own server and maybe even your own ISP. The code will be protected, but the publishing is not!

a day ago

dghlsakjg

“Our clickwrap terms of service prohibit users from talking about dangerous defects in our products without telling us and keeping it a secret for a month” is a hell of an argument to even attempt in front of a judge, let alone to be accepted.

Again, there isn’t really any case law I can find suggesting that skipping responsible disclosure opens you to any legal liability - which is the argument being made here.

19 hours ago

1970-01-01

The dispute is whether or not it is perfectly legal free speech. By simply publishing it on GitHub, it was a violation of a TOS and that right there opens it up to lawsuits from MS. You are free to go down this path and prove me wrong.

a day ago

bigfatkitten

I’d be interested to read some case law involving judgements against researchers in these circumstances, if you have any references handy.

a day ago

1970-01-01

a day ago

bigfatkitten

Not comparable at all. He was convicted one count of identity fraud and one count of conspiracy to access a computer without authorization — AT&T’s computer, not his computer.

a day ago

h4kunamata

Since Microsoft took over GitHub, everything went to shit.

GitHub, dead!

Windows, dead!

Xbox, dead!

Now security analysts blacklisted for disclosuring vulnerabilities.

Wait until the big players decide to ditch Microsoft altogether, I mean, why help when you are penalized for it??

With Microsoft doing so many things wrong, and users migrating to Linux because even Windows softwares have become evil, and security analysts jumping ship, let me tell ya, Copilot or even Mythos won't save you. AI is as good as the data it was trained on while humans adapt on the fly.

a day ago

h4kunamata

EDIT: This security analysts promised to release something big on July 14, 2026

Boy oh boy, Microsoft started a war they cannot afford to loose, and yet they already lost.

a day ago

justinclift

It's crazy MS are doing this after the US Gov people publicly lambasted them (ie https://www.inc.com/kit-eaton/why-a-former-white-house-cyber...), with MS then promising to make security a core thing at MS to fix the problem.

This isn't "fixing the problem" at all. It's the opposite of fixing the problem.

20 hours ago

bigfatkitten

Microsoft did make security a core thing, back in 2002, and they made enormous progress in improving their product security.

https://www.wired.com/2002/01/bill-gates-trustworthy-computi...

Nadella subsequently pushed security to the back seat.

14 hours ago

justinclift

The promise I'm talking about was 2024/2025, and we can see how that's gone. ;)

4 hours ago

angry_octet

If you can't win the game, don't play by the rules.

a day ago

HDBaseT

I wouldn't call these "Exploits".

Almost all of these appear to be backdoors inserted by Microsoft (and/or three letter agencies/Israel).

They are just being blown open and Microsoft isn't happy.

a day ago

xtajv

[dead]

a day ago

1970-01-01

>Hang on.. proof of concept exploit creation and distribution for zero days is “criminal activity” now?

This is what happens when you jump the gun and publish without doing any research. The author needs to lookup how the CFAA works. Now, yesterday, and a decade ago, you couldn't just drop some exploit and walk away rambling about your rights. Dumpster fire takes are everywhere online.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C...

2 days ago

bigfatkitten

Notice how the blog post is attributed to “MSRC Team”. The author (or their manager) is too cowardly to put their own name to the piece.

a day ago

keepupnow

Have respect for the researcher, they are incredibly talented and generous.

a day ago

1970-01-01

A bad take is a bad take.

a day ago

angry_octet

You're referring to completely tangential cases.

Maybe you should look up who the author is.

a day ago

snickerbockers

Those are some very bold legal threats considering their founder is an epstein associate.

2 days ago

1970-01-01

Considering Bill hasn't been Microsoft CEO for only 2.6 decades, these things are probably directly related.

a day ago

keepupnow

Bill is still pulling the strings.

a day ago

TacticalCoder

> Microsoft's stance on zero day exploits is a dumpster fire of their own making

The words "'s stance on zero day exploits" are unnecessary in the above sentence.

2 days ago