5 ms·
My understanding is that “disclosure” is a nuanced thing, time-wise: responsible disclosure is to mention the vulnerability to someone who can and is intent to
by bertil 11y ago
My understanding is that “disclosure” is a nuanced thing, time-wise: responsible disclosure is to mention the vulnerability to someone who can and is intent to fix it first, give them the time to write, test and send a patch, and then publish it. Publishing it earlier sound very unreasonable, especially before handing the details to the manufacturer.
I am not familiar with what Schneier said 15 years ago, though. He might have chastised someone for doing that; he might have changed his mind. If he hasn’t in a decade and a half, I’d be shocked.
I realised this morning that 15 years ago, I was proud of using SAS, “the most powerful analytics software there [was]”. I changed.
- tptacek 11y agoThere is no such thing as "responsible disclosure". That's a term invented by vendors to coerce independent researchers into doing free work for them. Semantic drift has somewhat legitimized the term, but I think it's important we remember why it was conjured in the first place.
- wolf550e 11y agoHow would you call Google Project Zero's 90 day policy?
- chopin 11y agoDoesn't Google do free work for the vendors with this project? I would assume so.
- wglb 11y agoIt is imposed by Google, not the vendor of the broken software.
- tptacek 11y agoA decision they had every right to make for themselves, but that they have no right to impose on anyone else. I'm pretty sure Tavis Ormandy agrees with me.