16

The question arose on a recent discussion about how package protection could possibly be circumvented. I think there might be other security problems that e.g. concern the CDF plugin or network features. If anyone finds such a problem, would we like this to be published here?

In general, I think openness concerning security problems is a very good and a proven approach. It is a different story whether it is good for the site if such issues are made public here. We could e.g. loose the benevolence of WRI personnel who have an important impact on the quality of the site. I would especially encourage those WRI internals to give their opinion.

| |
  • I have risen this question in the hope for a discussion about what to recommend to users. Now I have given one such recommendation as an answer to my own question, but am not sure what the further course of action might be. What would accepting an answer mean in such a discussion? Would the count of upvotes count as an acclamation of the community? I'm not sure what I should do to help to achieve an accepted outcome from such a discussion... – Albert Retey Feb 20 '12 at 13:03
4

I have been thinking about that as well. With the power of Mathematica to execute external programs (rm -rf *.* style) and all the possibilities and hidden dangers dynamic content offers in combination with Mathematica programs' self-modifying capabilities one wonders whether the built-in countermeasures are sufficient. Up to now, I have been exchanging notebooks with complete strangers. The Mathematica community is a benevolent one, but with the emergence of new technologies like CDF it might be that the dark side will be getting interested as well and swapping notebooks might not be a good idea anymore.

Having said that, I wonder whether a discussion in the open is a good idea. Of course, security by obscurity is an idea proven wrong many times, but without any good mechanism to reach (and protect) the millions (?) of Mathematica users out there it doesn't sound like a good plan to discuss security issues completely in the open. My current thinking is that I would favor a more closed-off platform for this kind of discussion.

| |
  • 1
    CDF seems pretty safe to me. It is Mathematica itself which is considered by some IT-people as not-safe. – Rolf Mertig Feb 10 '12 at 23:34
  • @Sjoerd: would that mean you would vote for a "we don't want exploits to be published here" strategy? I think we should try to clearly discriminate between what good security models for Mathematica could be in general and what would be a good proposed etiquette for MSE. Only the latter is what I intended to be discussed here... – Albert Retey Feb 11 '12 at 22:03
4

While there was some interest in the question, there haven't been many new entries for quite a while. After reading what has been mentioned here, a week of reflecting and some private communication I would propose the following:

We should recommend to not use MSE to make technical details of exploits public, it would probably not be in the interest of this site and some (most?) of its users. We should rather recommend to send any security issues to WRI as bug reports. If someone thinks making details about vulnerabilities public is due, there are other sites about security issues where such information is better housed.

Despite the interest of this site and its users there are other arguments for the recommended procedure: While in general I think openness concerning security issues is a good and proven approach, it is also considered fair and common practice to give software vendors a chance to fix these issues before making them public. Additionally I guess bug reports will have a higher chance that WRI actually realize the users (our?) needs and actually take actions.

| |
  • I'm certainly interested in learning how Mathematica is insecure. It's not a question of hiding sensitive information from hackers, but informing programmers of their probable mistakes and bad habits. I like @Sjoerd 's idea of a private chatroom. – CHM Mar 30 '12 at 21:03
1

The fact seems to be that part of that discussion from earlier today got deleted. Not sure if this is good. WRI-people will probably not position themselves here at all.

@Sjoerd: Which closed-off platform are you thinking about?

Also, somehow I think WRI should fix this and provide more security in general (they did think quite a bit about security both for CDF and for webMathematica).

| |
  • 1
    I deleted it, because I think that at present this will bring more harm than good. I agree with @Sjoerd: there is no mechanism in place right now, while there may be many people depending on this for their current products. This wasn't clear to me initially, but I became convinced now. Users may raise concerns about these matters, but it is not the same as an expert-level discussion of the specific security weaknesses. Once I realized that a discussion is moving that way, I decided that it will be best to stop it here, where it is available to anyone. Rolf, I am sorry if that disturbed you. – Leonid Shifrin Feb 10 '12 at 23:53
  • @Rolf: Am I misunderstanding that you would propose that we should encourage to publish exploits here so WRI becomes aware of them and feels some pressure to fix these? Do you think that such activities could become counterproductive concerning the acceptance and the standing of MSE? The latter is what I think we should think about when proposing an etiquette on that topic, which to my understanding of course would/could/should not be imperative in any way. – Albert Retey Feb 11 '12 at 22:17
  • @Leonid && Albert: fine. Let's not discuss this in detail. I think WRI should address this issue, maybe there can be some kind of $SystemLocked flag which would lock a lot of basic functions and then products could rely on such a flag being true to be sure that e.g. Module and Locked and CompoundExpression etc. are not changed. MSE should not issue any pressure at all since that will not work. Just raise some topics and make suggestions. It is up to Roger and SW and others to make decisions. And they have listened in the past to users and developers, so I am sure they will do so in the future. – Rolf Mertig Feb 11 '12 at 22:31
  • @RolfMertig mma is already denying access to certain functions if the notebook isn't in the trusted path (see reference.wolfram.com/mathematica/tutorial/…). The question is whether this is sufficient. – Sjoerd C. de Vries Feb 12 '12 at 7:23
  • I didn't have a particular platform in mind, but I believe it's possible to create a private chat room. Normal chat rooms are searchable by Google c.s. – Sjoerd C. de Vries Feb 12 '12 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .