2 ms·
> Do not publicly disclose information about the vulnerability and vulnerable systems without the CCB’s consent This one would be a sticking point for me, pers
by Retr0id 4y ago
> Do not publicly disclose information about the vulnerability and vulnerable systems without the CCB’s consent
This one would be a sticking point for me, personally. When disclosing vulns, I am extremely reluctant to relinquish control over who I tell and when. I wonder if participation in this mechanism could increase one's overall liability.
- sva_ 4y agoThis makes it sound like they're fishing for some zero-days.
- tptacek 4y agoIf they wanted zero days they would just buy them, like everybody else does.
- meinheld111 4y agoWell they are paying with protection
- jraph 4y agoI don't think so, they require you to also tell the author as soon as possible, if not before. I'd think notifying them as soon as possible and asking them for permission for publicly disclosing would let them protect you more efficiently.
- tptacek 4y agoYou presumably retain the ability to control disclosure about vulnerability research you conduct against authorized targets; the most common class of authorized targets is "software you run yourself, in settings where vulnerabilities don't involve talking to other people's computers/servers". Where people get into trouble is when they authorize themselves to conduct research against other people's computers. If you want firm control over the disclosure of your vulnerabilities, find other people's computers that authorize testing, or test your own computers.