Skyfall and Solace vulnerabilities

Security research is a wonderful thing. This is not that. If and when a vulnerability is ready for public disclosure, then fine: make a webpage with a cute logo and name, informal details of the issue and links to formal papers or bug reports. At that point you’ve earned whatever fame you get.

Ever since Heartbleed and Shellshock, I’ve basically given up on my vendetta on the use of logos and marketing names for serious vulnerabilities. I accept the practice is good for driving awareness and encouraging updates. But I’m putting my foot down here: this is nonsense. What exactly can we learn from this website? Some undisclosed party has an undisclosed vulnerability that is implied to be as serious as Meltdown and Spectre? Seriously?

This really should not be encouraged in the security industry, which already has to fight against controversies surrounding disclosure guidelines and stunt hacking. Now we have a page that is attempting to bring awareness to a vulnerability that, for empirical purposes, does not exist yet. The only logical conclusion I can see for why a researcher would do this is to try to proactively claim a plot of land they can use to stake a vulnerability on later (so to speak). This seems to be especially the case since so many parties independently discovered the Meltdown and Spectre vulnerabilities.

This is not how research works, and I consider it a breach of ethics for a security researcher to attempt a public marketing campaign before the vulnerability can be investigated by peers. You don’t get to proactively claim credit before you publish something, that’s antithetical to research in general. The only justification is fame seeking. What if the media runs with this on basically no information, and it later turns out to be nothing at all? Who is responsible in that scenario? What if that impacts Intel’s stock price, or causes another panic without any discernible details?

It’s irresponsible and denies others of the right to investigate veracity. If you want press, put out promotional materials when you put out technical details so your work can be examined from an academic standpoint instead of just a media-frenzied one.