3 ms·
In my mind (biased) responsible disclosure includes ensuring that a respected database for tracking security issues has the issue described and publicly availab
by inetknght 9y ago
In my mind (biased) responsible disclosure includes ensuring that a respected database for tracking security issues has the issue described and publicly available either before or at the same time that a blog publicly discusses it. Otherwise the impression is that the blog is discussing a security issue before it's been addressed by interested parties.
That's just my opinion. Whether or not that's the "definition" of responsibility is of course up for discussion.
- patcheudor 9y agoI've got two and three year old vulnerabilities I've disclosed which have CVE's which are still not populated. This is very common. No one waits for the CVE to be populated before going public.
- inetknght 9y agoI understand and that's quite unfortunate. Nonetheless, my opinion is my own and I see nothing to change it so far.
- justinclift 9y agoThe delay seems like it's caused by the people who update the database just not having the time to get it done. Or alternatively, just not prioritising it for the time they have. Either way of looking at it, delaying release of vuln info to wait for the above to happen seems like it would let vulns keep in-the-wild-and-unknown for much longer. That being said, if you're able to assist with or fix the not-enough-time-to-get-things-done problem, it wouldn't hurt. :)