4 ms·
But those aren't the same thing. The basic idea of "responsible disclosure" is that you give the vendor enough time that they could make and deploy a patch. T
by Dylan16807 1y ago
But those aren't the same thing. The basic idea of "responsible disclosure" is that you give the vendor enough time that they could make and deploy a patch. This might involve coordination or it might involve an upfront deadline. "Responsible disclosure" by itself doesn't give the vendor any control. (Unless you're worried about them suing you, but if you're worried about that your whole strategy needs to change far beyond disclosure timing.)
If you want a different term that's fine, but I don't agree with framing it as all or nothing or the suggested replacement.
- akerl_ 1y agoGiving the vendor a deadline up front is coordinating with the vendor. You brought them in on a plan for what you’re going to do and asked them to take actions as part of that plan.
- Dylan16807 1y agoReporting the bug to the vendor is coordinating in a weak sense, but you're not coordinating the disclosure unless they have input in how the disclosure happens. If an email asking them to fix it qualifies as coordinated disclosure, then an immediate public post about the bug is also coordinated disclosure. It also brings them in and asks them to take actions.
- tptacek 1y agoEven "responsible disclosure" didn't necessarily give vendors input into "how" the disclosure happened, only "when".
- tptacek 1y agoThere is no basic idea of "responsible disclosure". The term was literally coined so that vendors could call researchers "irresponsible" when they didn't do what the vendors asked. Sometimes immediate disclosure is warranted!
- Dylan16807 1y agoI get it, you don't like that term. But the idea of releasing after a fixed delay is fine. That idea should have a name. We shouldn't imply that releasing after a delay and giving the vendor power over it are the same thing. They should not be lumped together under "coordinated disclosure".
- tptacek 1y agoIt does have a name. The name is "coordinated disclosure". Coordinated disclosure isn't an absolute good; it often is, and the name is descriptive of the goal. "Coordinated disclosure" very specifically does not mean "giving the vendor power over it".
- Dylan16807 1y agoCoordinated disclosure is a terrible term to use when there is no coordination of the disclosure!! It should not be what we call "Here's a bug report, by the way I'm posting publicly in 90 days."
- tptacek 1y agoThis is not an interesting debate. There are two terms in common use. I didn't make either of them up. One is coercive and Orwellian; the other, according to you, is imprecise. I'll live with the imprecision. If you want to call a disclosure "irresponsible", be prepared to litigate based on the facts of that particular case; there are very few universal ethical rules of disclosure, and those few are only rarely broken in blog posts.
- Dylan16807 1y agoLet's use neither term in some situations then. It's not just "imprecise" when the term claims exactly one thing and that thing didn't happen. If people start referring to any non-immediate disclosure as "coordinated", that causes the same kind of bad effect you were worried about. People get pressured to coordinate because they think most researchers are always coordinating. I don't want that to happen either. I would never say "irresponsible" just because of timing. You're right that "responsible" is a mess. But "coordinated" if misused also is a mess and also gets coercive.