3 ms·
Is it? I think "Responsible Disclosure" involves cooperation with the vendor before releasing any information, e.g. Project Zero is responsible disclosure beca
by segfaultbuserr 7y ago
Is it?
I think "Responsible Disclosure" involves cooperation with the vendor before releasing any information, e.g. Project Zero is responsible disclosure because the information is released after the problem is patched. I label all disclosure of unpatched vulnerability without cooperation with the vendor as "Full Disclosure".
- MaxBarraclough 7y ago> I think "Responsible Disclosure" involves cooperation with the vendor before releasing any information, e.g. Project Zero Good point. > I label all disclosure of unpatched vulnerability without cooperation with the vendor as "Full Disclosure". If you aren't disclosing everything you have, it's not full disclosure, it's some other disclosure model. I think we're just arguing semantics though, as I fully agree with your earlier paragraph, that hardware vulnerabilities are trickier than software vulnerabilities regarding disclosure, and that Project Zero is doing roughly the right thing.