4 ms·
Isn't responsible disclosure the aim here? I don't think substituting coordination for responsible is a sensible strategy for your project. The coordination is
by jpswade 9y ago
Isn't responsible disclosure the aim here? I don't think substituting coordination for responsible is a sensible strategy for your project.
The coordination is inherit from the fact that they are honouring your disclosure policy. The word coordinated is redundant.
Objectively, it should be called a "security disclosure" policy.
- jph 9y agoYou make good points. How would you improve it to clarify the aim is to be generally useful for both sides? For example, when I personally discover a security issue, I want to be able to report it to a company, and also include a link to this doc, and ask "Here's how I suggest we interact and why; what do you think?".
- tptacek 9y agoOnce again, "responsible disclosure" is a term of art in the industry, and it communicates something he probably doesn't mean to communicate.