3 ms·
As a supporter of Full Disclosure I believe it is irresponsible to follow the so called "Responsible" disclosure model. I dont believe it is "responsible" to l
by syshum 10y ago
As a supporter of Full Disclosure I believe it is irresponsible to follow the so called "Responsible" disclosure model.
I dont believe it is "responsible" to leave people exposed for 90+ days while the vendor attempts to whitewash and cover up their vulnerabilities as it so often the case.
While some software vendors might respond the vulnerabilities properly, most do not often wanting to blame shit, or even file legal action against anyone discovering vulnerabilities.
- CiPHPerCoder 10y agoThe term "responsible disclosure" is actually a bad term to use, even if you support it: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is... TL;DR "coordinated disclosure" is preferred.
- mikhailt 10y agoIt depends on the situation but I agree with the better name for this, coordinated disclosure. If the vendor refuses to do anything, then yes, the 90 days should be waived. I'm not saying we shouldn't disclose at all, I'm saying the vendors have the right to have the info first and react before the said announcements start.