4 ms·

It's generally the thing to do, whether governement or lone programmer —security is a collective matter, bigger than us. Just like we notify people when there'

by K0SM0S 7y ago

It's generally the thing to do, whether governement or lone programmer —security is a collective matter, bigger than us. Just like we notify people when there's a fire hazard, we don't just stand idle when many people are at risk of something.

colejohnson66 7y ago
A problem arises when you notify them they have a security hazard: they either ignore it, or threaten a lawsuit if you don’t shut up.
- AnthonyMouse 7y ago
  Some government -- anywhere in the world -- should offer a responsible disclosure service. You disclose to them a vulnerability, anonymously (e.g. via Tor) if you prefer, then they notify the target and impose a reasonable remediation deadline before publication. And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.
  - ipsa 7y ago
    In the Netherlands there is the NCSC (National Cyber Security Centre). They also scan the internet: It continuously monitors all (potentially) suspect sources on the internet. When it identifies a threat (such as a virus or an attack on a website), it alerts public authorities and organisations. and can act as a mediator: If you discover a security flaw in another government body (such as a municipality or province) or in an organisation with a vital function (such as an energy or telecoms company), please contact the body or organisation first. If you receive no response, please notify the National Cyber Security Centre, which will mediate between you and the body or organisation concerned. with anonimity garantuee: The government treats the notifications it receives confidentially. It will not share your personal details with third parties without your permission unless required to do so by law or a court order. while avoiding court cases for doing your civic duty: When you report the security flaw, check that you comply with the conditions described above. If you do so, the government will not attach any legal consequences to your notification.

by K0SM0S 7y ago

colejohnson66 7y ago

A problem arises when you notify them they have a security hazard: they either ignore it, or threaten a lawsuit if you don’t shut up.

AnthonyMouse 7y ago
Some government -- anywhere in the world -- should offer a responsible disclosure service. You disclose to them a vulnerability, anonymously (e.g. via Tor) if you prefer, then they notify the target and impose a reasonable remediation deadline before publication. And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.
- ipsa 7y ago
  In the Netherlands there is the NCSC (National Cyber Security Centre). They also scan the internet: It continuously monitors all (potentially) suspect sources on the internet. When it identifies a threat (such as a virus or an attack on a website), it alerts public authorities and organisations. and can act as a mediator: If you discover a security flaw in another government body (such as a municipality or province) or in an organisation with a vital function (such as an energy or telecoms company), please contact the body or organisation first. If you receive no response, please notify the National Cyber Security Centre, which will mediate between you and the body or organisation concerned. with anonimity garantuee: The government treats the notifications it receives confidentially. It will not share your personal details with third parties without your permission unless required to do so by law or a court order. while avoiding court cases for doing your civic duty: When you report the security flaw, check that you comply with the conditions described above. If you do so, the government will not attach any legal consequences to your notification.