,
18 tweets,
4 min read
Read on Twitter
Since ancient times, members of the #infosec tribe have adhered to a set of rigid Rules of Branded Vulnerabilities across the cybersphere.
These rules apply equally regardless of actual merit, impact, or practicality of the vulnerability in question. They are:
1) After a vulnerability is discovered and confirmed, the first cause of action is to register a domain name.
2) A logo is drawn, preferably using MS Paint.
3) Vendors are contacted, embargo periods set, then extended.
4) OpenBSD patches silently anyway. Nobody notices. The embargo is extended a few more times.
5) As the publication date nears, abstracts, hints, and partial patches are leaked.
7) The Big Day! Branded site goes public. Tweets are tweeted. @dangoodin001 writes a quick summary. It's pretty good.
8) Everybody tweets. @cloudflare posts a blog post how everybody but them is vulnerable.
9) The #infosec chattosphere ridicules the branding, while at the same using it to mansplain the vulnerability to each other.
10) @matthew_d_green posts a blog entry, covering the important parts in just the right detail. @mattblaze makes apt & biting comments.
11) @SwiftOnSecurity and @thegrugq RT useful links 24/7, somehow manage to add actually interesting comments. Sleep is for the weak.
12) @erratarob disagrees with everybody, if not completely, then at least on some key aspect. Somehow he's right about that.
13) Time elapses. Some of the notified vendors push announcements. Most of the rest don't do anything.
14) "Cyber" vendors spread and exploit FUD around the vulnerability to hawk their products, although those wouldn't have helped at all.
15) Time elapses. People try to patch, realize that's work and stop halfway through.
16) Time elapses. Not much changes. #Infosec moves on to the next branded vuln.
The circle of cyber life continues. Hakuna matata. Eat Arby's.
