3 ms·

I'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's

I'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's about providing details earlier to a group of people who have a strong enough vested interest that they are willing to pay for it and have been vetted as trustworthy enough to allow it. Given how important OpenSSL is to the web's infrastructure (and the many companies who utilize it), I think there would be value in ensuring it has appropriate resources to fulfill that duty. This idea may not be a perfect solution, but calling it a "stunt" is hyperbole, IMO.

cperciva 13y ago
The FreeBSD Security Team works with other software distributors to make sure that they have advisories and patches ready when bugs are first disclosed publicly. In my years as FreeBSD Security Officer, we in very rare cases gave advance notice of vulnerabilities to end users, and those decisions were made on the basis of "we happen to know that these people are using the software in a way which makes them particularly vulnerable". (In most or all such cases we didn't even provide a patch, just a warning of "make sure you have people around at 10AM tomorrow in case you need to release an update quickly".) Nobody ever got advance notice by virtue of having donated money, and I reminded Security Team members that they should not give any advance disclosure to their employers.
phil21 13y ago
>This isn't about delaying details to anybody Yes it is. If you disclose early to a select group, you are by definition delaying details to everyone else. The paid early disclosure stuff used to exist all over the place, and it was a joke in terms of it being immediately leaked to those in the know.
- SoftwareMaven 13y ago
  Except you can't give security vulnerability details to everybody until you have a patch ready (and I certainly wouldn't argue that you should allow paying for earlier access to the patch). On the other hand, when you have a business relationship with somebody, with non-disclosure agreements in place, you can tell them more details much earlier.

cperciva 13y ago

The FreeBSD Security Team works with other software distributors to make sure that they have advisories and patches ready when bugs are first disclosed publicly. In my years as FreeBSD Security Officer, we in very rare cases gave advance notice of vulnerabilities to end users, and those decisions were made on the basis of "we happen to know that these people are using the software in a way which makes them particularly vulnerable". (In most or all such cases we didn't even provide a patch, just a warning of "make sure you have people around at 10AM tomorrow in case you need to release an update quickly".) Nobody ever got advance notice by virtue of having donated money, and I reminded Security Team members that they should not give any advance disclosure to their employers.

phil21 13y ago

>This isn't about delaying details to anybody Yes it is. If you disclose early to a select group, you are by definition delaying details to everyone else. The paid early disclosure stuff used to exist all over the place, and it was a joke in terms of it being immediately leaked to those in the know.

SoftwareMaven 13y ago
Except you can't give security vulnerability details to everybody until you have a patch ready (and I certainly wouldn't argue that you should allow paying for earlier access to the patch). On the other hand, when you have a business relationship with somebody, with non-disclosure agreements in place, you can tell them more details much earlier.