3 ms·
>Regarding this, public disclosure before private disclosure is unethical. I guess you consider Bruce Schneier a peddler of unethical behavior, then? He mainta
by icelancer 13y ago
>Regarding this, public disclosure before private disclosure is unethical.
I guess you consider Bruce Schneier a peddler of unethical behavior, then? He maintains the threat (and execution) of full disclosure is vital to maintaining security.
- sigzero 13y agoBruce does NOT advocate an end run around the provider. You talk to the provider first, always.
- yeukhon 13y agoExactly. Full disclosure does this. Before full disclosure was the norm, researchers would discover vulnerabilities in software and send details to the software companies -- who would ignore them, trusting in the security of secrecy. Some would go so far as to threaten the researchers with legal action if they disclosed the vulnerabilities. https://www.schneier.com/essay-146.html https://www.schneier.com/essay-146.html If the code is public, just fixing the code without CVE or similar is considered bad because diffing the code will yield the vulnerability. You don't go around and tell people you found a vulnerability until it is fixed (in the case of vendor ignoring alert it is ethical to tell the public).