3 ms·
> Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability Imagine they know of a vulnerability but believe that it's n
by shawnz 9y ago
> Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability
Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it.
It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.
- baddox 9y agoIf it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to notify the vendor privately, then disclose publicly after some period of time if the vendor is uninterested or unresponsive, with the idea being that it’s safer in the long run for vulnerabilities to be publicly known than only known to a small number of parties (since some of those parties may be trying to exploit the vulnerability).
- dspillett 9y ago> If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? Because of the public? If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?
- baddox 9y agoBut this is the entire point of bug bounties, right? Companies literally pay people to find vulnerabilities in their software.
- tptacek 9y agoI don't follow. You're describing a circumstance in which you report a vulnerability the vendor already knows about. What did you expect?