4 ms·
Done. Thank you for the advice, and all your security work. https://github.com/joelparkerhenderson/coordinated_disclosure https://github.com/joelparkerhenderso
by jph 9y ago
Done. Thank you for the advice, and all your security work.
https://github.com/joelparkerhenderson/coordinated_disclosure https://github.com/joelparkerhenderson/coordinated_disclosur...
If you have anything more you want in it, please let me know.
- jpswade 9y agoIsn't responsible disclosure the aim here? I don't think substituting coordination for responsible is a sensible strategy for your project. The coordination is inherit from the fact that they are honouring your disclosure policy. The word coordinated is redundant. Objectively, it should be called a "security disclosure" policy.
- jph 9y agoYou make good points. How would you improve it to clarify the aim is to be generally useful for both sides? For example, when I personally discover a security issue, I want to be able to report it to a company, and also include a link to this doc, and ask "Here's how I suggest we interact and why; what do you think?".
- tptacek 9y agoOnce again, "responsible disclosure" is a term of art in the industry, and it communicates something he probably doesn't mean to communicate.