Login
You're viewing the social.telemetrydeck.com public feed.
  • Buttered Jortsajn142@infosec.exchange
    Oct 13, 2026, 3:29 PM

    @mttaggart posting here because i just shared the link with coworkers and don't feel like being recognized, but had a different (maybe naive) perspective on your latest at @ifin

    The early rumors of 0-days in Netscalers were at best unhelpful, at worst a signal to attackers to increase their efforts on that attack surface.

    I can't entirely get behind that. Did they contain actionable intelligence? No. But as much as they may have been a signal to attackers, they were also a signal to defenders to start looking, start demanding information from the vendor, and without that signal I think we would have seen the vendor continue to sit on the advisory on their timeline.

    There's a lot of noise to signal in RUMINT, and I don't think we as defenders should dedicate much time or resources to addressing it, but I do think there's value in keeping our ears open and being generally prepared to act or investigate further where the volume hits critical mass or the combination of risk and confidence exceeds our thresholds. I think that also extends to sharing RUMINT at a personal level with careful attribution and clear delineation as rumor, so that others can make their own evaluations based on their threat models.

    💬 2🔄 3⭐ 3

Replies

  • Buttered Jortsajn142@infosec.exchange
    Oct 13, 2026, 3:38 PM

    @mttaggart @ifin not to say that's a position I think IFIN should take in the information it shares, but maybe a reasonable position on what we as individuals should share with each other, and with communities like IFIN. There's definitely a risk of false positives and alert fatigue that make filtering at a certain level a net good. But there's a difference between the boy who cried wolf and being the person who credibly said "I heard the boy cry wolf" and I think sometimes we worry enough about being part of the former that we miss the value in the latter.

    💬 0🔄 0⭐ 0
  • Taggart :ifin:mttaggart@infosec.exchange
    Oct 13, 2026, 3:35 PM

    @ajn142 @ifin I understand your perspective, but I'm sticking to it. Until we at least knew what to look for besides "something bad in Citrix Netscalers," something that was at the time unconfirmed by the vendor (even though it could have been), what we had was a FUD generator. Compare that to the counterfactual where the vendor was as up-front as possible, given what we know they knew and when.

    💬 1🔄 0⭐ 0
  • Buttered Jortsajn142@infosec.exchange
    Oct 13, 2026, 3:53 PM

    @mttaggart @ifin that's ok, I'm not trying to change your mind ;)

    I'm saying what I think, and whether it influences your thoughts or not is on you. I'm of the opinion that in a lot of things there aren't perfectly right answers, but a broad arc of directionally correct ones, sometimes evenly distributed between the poles and sometimes with nodes between that are more or less optimal. I think talking through them is worth it, even if nobody changes their mind at the end.

    💬 1🔄 0⭐ 0
  • Taggart :ifin:mttaggart@infosec.exchange
    Oct 13, 2026, 4:01 PM

    @ajn142 @ifin I think that's broadly reasonable, but your comment was about a specific instance where we have some contraindicating facts.

    In my view here's what was unhelpful: RUMINT about one, two, or more 0-days.

    What was helpful: the (rescinded) NCSC-NL advisory with actual intelligence, and the community-shared reports of exploitation, along with indicators. To your point, it was these reports that created the pressure on the vendor to move quickly, as it should have. And again, this was information that met the criteria I lay out in the post. That's distinct from the unsubstantiated rumors at the beginning, which in my view had minimal effect on the vendor.

    💬 0🔄 0⭐ 0
  • Taggart :ifin:mttaggart@infosec.exchange
    Oct 13, 2026, 3:39 PM

    @ajn142 @ifin So this is why in the piece I make a distinction about incomplete information. Share that, don't share it broadly. Once it's a fuller picture with defensive action, broadcast.

    💬 1🔄 0⭐ 0
  • Buttered Jortsajn142@infosec.exchange
    Oct 13, 2026, 4:41 PM

    @mttaggart @ifin i think that comes into the gray area of "what's sharing broadly"?

    Using NetScaler as a model, the IFIN blog or Intel feed is definitely broad, and mentioning it to my friend the NetScaler guru definitely isn't. But is posting it to my ~600 followers, when maybe 50% of them aren't active on a given day, 50% of active aren't in infotech or infosec, 75% of those don't have Citrix in their org, are those 40 people (who may not work with it) broad? Or the 600 i could possibly reach? Does that change if the audience is smaller but a tighter match for relevancy, e.g. post in the General category of IFIN's forum acknowledging the rumor and asking what others are seeing, or the chat?

    To my earlier statement, I think this is another case where there is a broad arc with a number of reasonable differences of opinion on where the threshold is, and so that's going to be a judgement call every time, for every person. It's worth recognizing that in absence of a clear standard that's part of e.g. community rules, everyone will draw that line differently, and it's a place for everyone to give grace when they inevitably disagree with someone's judgement about what is sharing vs broadly sharing, and whether they think the person sharing should have waited or come forward sooner.

    💬 0🔄 0⭐ 0