3 ms·
Do you think that it is likely that NSA, et al., are NOT monitoring messages sent to the security/vulnerability reporting e-mail addresses that many vendors pub
by jlgaddis 11y ago
Do you think that it is likely that NSA, et al., are NOT monitoring messages sent to the security/vulnerability reporting e-mail addresses that many vendors publish?
Knowing what we do just from the Snowden disclosures, monitoring those aliases is exactly the type of thing I would expect them to do. Even if they only get 60-90 days before a vulnerability is "killed", that still leaves them a fair amount of time to utilize them against their targets.
- tptacek 11y agoIf you think NSA is going to read the emails you send to a vendor, you either PGP the documents you're sending, or you use a different channel to contact the vendor. The big vendors make that easy, and this is exactly the reason most of them post PGP keys. I super-duper don't care if you alert vendors before telling the public about a vulnerability. I think "responsible disclosure" is doublespeak, and I've generally supported direct- to- the- public disclosures for my whole career; I've written some articles justifying it (for instance: even if there's no patch, people can simply stop using the vulnerable software). But giving vendors a heads-up is at least neighborly (to the vendor) and, increasingly, a sign of professionalism, and "the NSA will get my bugs" is not a good reason not to do it.
- jlgaddis 11y agoYou said all that and still managed to not answer the question. It's okay, though, it was somewhat rhetorical (I already know what you'll say).