3 ms·

It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.

by c0pium 3y ago

hiatus 3y ago
Any basis for this statement? Having been through multiple pentests I have never seen any clause like that in a contract. Given the commoditized nature of security vendors these days, I would be surprised to see such an anti-customer clause become commonplace.
- c0pium 3y ago
  Why would you think I’m talking about pentests? Those are largely checkbox engagements run by people who use some automated tool; they’re pretty unlikely to find 0-days. I’m talking about real security audits, where a researcher takes significant time to understand a codebase. Those tend to be conducted by people and firms who know what they’re doing and can be picky about who they work with. The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well.
  - hiatus 3y ago
    I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds like the "real security audits" you are talking about. > The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. All of the engagements I have been a part of have had NDAs and public disclosure of vulnerabilities would probably result in a lawsuit, but these have been for private companies. > My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well. Do you work for an organization or just yourself?

It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.

by c0pium 3y ago

It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.

hiatus 3y ago

Any basis for this statement? Having been through multiple pentests I have never seen any clause like that in a contract. Given the commoditized nature of security vendors these days, I would be surprised to see such an anti-customer clause become commonplace.

c0pium 3y ago
Why would you think I’m talking about pentests? Those are largely checkbox engagements run by people who use some automated tool; they’re pretty unlikely to find 0-days. I’m talking about real security audits, where a researcher takes significant time to understand a codebase. Those tend to be conducted by people and firms who know what they’re doing and can be picky about who they work with. The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well.
- hiatus 3y ago
  I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds like the "real security audits" you are talking about. > The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. All of the engagements I have been a part of have had NDAs and public disclosure of vulnerabilities would probably result in a lawsuit, but these have been for private companies. > My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well. Do you work for an organization or just yourself?