3 ms·
If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to not
by baddox 9y ago
If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to notify the vendor privately, then disclose publicly after some period of time if the vendor is uninterested or unresponsive, with the idea being that it’s safer in the long run for vulnerabilities to be publicly known than only known to a small number of parties (since some of those parties may be trying to exploit the vulnerability).
- dspillett 9y ago> If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? Because of the public? If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?
- baddox 9y agoBut this is the entire point of bug bounties, right? Companies literally pay people to find vulnerabilities in their software.