5 ms·
How is full disclosure better than patching open source or contacting vendors and providing them with a discreet update?
by req2 17y ago
How is full disclosure better than patching open source or contacting vendors and providing them with a discreet update?
- bcl 17y agoYou should submit patches and contact the vendors. But history has shown that many vendors will, in general, ignore you until a demonstrated exploit is available. They still believe that security by obscurity is a valid way to protect their customers. I should say that I am not a fan of 0-day exploit releases. You should at least try to convince the vendor to do the right thing. But failing that, a full disclosure release is the only way to force them to act. And by full disclosure I do mean a detailed description of the problem, with code demonstrating the exploit.
- branden 17y agoIt's not necessarily better in all circumstances, but it's an option that needs to be kept around. If the code's proprietary and the vendor refuses to release a patch in a reasonable amount of time, what choice do you have?