3 ms·
I can understand this. Both of these options are better than what it was like in the 90's though. Back then it was "inform company about a bug, and get a non-di
by ggggtez 8y ago
I can understand this. Both of these options are better than what it was like in the 90's though. Back then it was "inform company about a bug, and get a non-disclosure agreement forced on you or a visit from the FBI".
People forget that one of the reasons the 90's was such a hayday for hackers was that companies tried to fight hackers with court orders instead of actually fixing their stuff.
- kstrauser 8y agoThat's exactly right. I'm firmly of the opinion that "we'll give you 90 days to fix it before announcing" is responsible disclosure, as it motivates people to actually fix their stuff as opposed to filing the report away in the circular Jira.
- syshum 8y agoI can somewhat get on board until the moment a 0day is observed in the wild, then it should be disclosed. i can not protect my systems from things I am not aware of, allowing a vulnerability to be exploited for 60 days when on day 29 of "responsible disclosure" window the vulnerability was observed being actively exploited is not responsible either.
- kstrauser 8y agoI'm with you. On that day, I assume everyone in the world except me knows how to exploit my system, and the vendor is racing the clock.