[post] How to maintain best practice in CS?
Recently, I've repeatedly noticed the same pattern, mainly on LinkedIn: people, often with a combination of "cyber security researcher", "bounty hunter", "hacker" in the title and with a smaller outreach, are publishing vulnerabilities. Linking to their blog, where the vulnerability is being written up in full detail. So far, so normal for LinkedIn and its mechanics. BUT...
Two things are bugging me: first, calling yourself a research without doing research in terms of adhering to certain standards and methodologies, is harming other cs researchers and teams, who deliver brilliant and impressive technical work to the cyber security field. Not all claim being a research, but there are a few. There is no institution to judge, who is allowed to state he/she is a researcher in the field of cyber security or not. Which is a good thing, that there is no centralization. But on the other side, I have the impression, that the number of "black sheeps" is surging.
The second, and more concerning, thing that bugs me, is that there are more and more cases, where vulnerability write ups get published without disclosing the vulnerability to the manufacturer / company. Sure, there are companies, which do not react or simple ignore a disclosure. But this can't be an explanation for not providing a disclosure process or brief timeline of events, before someone publishes an exploitable vulnerability.
Surely, AI-detect vulnerabilities are making it easier to find and publish new CVE's. But again: the lack of standards and methodologies is becoming a problem in the light of security issues with web apps and services, fully exploitable by anyone eager enough to ask his/her LLM of choice to step by step guiding them through an exploitation.
Please, tell me if you have the same impression or if you have completely different stance on this topics. Or if I have even a wrong perception and over-dramatizing here. Let me know what you think.
Aristopunk
Two things are bugging me: first, calling yourself a research without doing research in terms of adhering to certain standards and methodologies, is harming other cs researchers and teams, who deliver brilliant and impressive technical work to the cyber security field. Not all claim being a research, but there are a few. There is no institution to judge, who is allowed to state he/she is a researcher in the field of cyber security or not. Which is a good thing, that there is no centralization. But on the other side, I have the impression, that the number of "black sheeps" is surging.
The second, and more concerning, thing that bugs me, is that there are more and more cases, where vulnerability write ups get published without disclosing the vulnerability to the manufacturer / company. Sure, there are companies, which do not react or simple ignore a disclosure. But this can't be an explanation for not providing a disclosure process or brief timeline of events, before someone publishes an exploitable vulnerability.
Surely, AI-detect vulnerabilities are making it easier to find and publish new CVE's. But again: the lack of standards and methodologies is becoming a problem in the light of security issues with web apps and services, fully exploitable by anyone eager enough to ask his/her LLM of choice to step by step guiding them through an exploitation.
Please, tell me if you have the same impression or if you have completely different stance on this topics. Or if I have even a wrong perception and over-dramatizing here. Let me know what you think.
Aristopunk
Login to comment.