3 ms·
But full disclosure places the general public at greater risk than responsible disclosure.
by afavour 3y ago
But full disclosure places the general public at greater risk than responsible disclosure.
- michaelt 3y agoLet's say hypothetically someone found this hacked website, sent an e-mail to the site owners' security reporting contact, and after a year they hadn't taken any action. Some would say a "responsible" disclosure which allows the danger to continue unabated for a year is a greater danger than a public disclosure, which would lead to the danger being fixed.
- afavour 3y agoThat is one hypothetical scenario, yes. Another hypothetical scenario is that as a result of responsible disclosure the site owners patch the hole and ensure customer data isn't publicly accessible before the vulnerability is public knowledge. Seems reckless to me to not even _try_ responsible disclosure. You don't have to wait a year. But at least give a chance for the problem to be solved before you make it common knowledge.
- michaelt 3y agoDid I say hypothetically? Sorry, I meant to say exactly as happened [1] :) [1] https://news.ycombinator.com/item?id=40169334 https://news.ycombinator.com/item?id=40169334
- afavour 3y agoRight, so that’s a dataset of 1. Are you suggesting responsible disclosure never works because of your one time experience?
- michaelt 3y agoOf course not. I agree that responsible disclosure works perhaps 10% of the time. It's the 90% of the time, when it doesn't work, that's the problem.
- lynx23 3y agoOnly in the very short term. In mid-to-long term it increases the incentive to actually roll out a fix sooner then later.
- busterarm 3y agoOr you can possibly decide to shut down whatever service is vulnerable.