3 ms·

I think this comment highlights a lack of understanding what responsible disclosure is about. It's there to reach the best possible tradeoffs to protect consume

by kerng 7y ago

I think this comment highlights a lack of understanding what responsible disclosure is about. It's there to reach the best possible tradeoffs to protect consumers and force a quick turnaround with fixes. Just publishing vulns, which the vendor might not even see or learn about(!), will not help in getting things improved and puts consumers knowingly at risk at scale.

FireBeyond 7y ago
I understand perfectly well what it is. But see my sibling comments, that reflect an agreement with the concept of "coordinated disclosure", rather than "responsible disclosure", which gives an implication that I am being irresponsible if I do not work to the vendor's needs and priorities.
- kerng 7y ago
  Publishing vulnerability details without informing the vendor is irresponsible.
- mlindner 7y ago
  "coordinated disclosure" is a newly invented term that I've never seen used anywhere in industry. Please don't simply invent new vocabulary and then define it as the standard.
ryanlol 7y ago
Perhaps you should come up with your own term to describe such disclosures instead of co-opting the well established one that means something else entirely?