4 ms·

There should be some kind of anonymizing escrow-type service that allows people/info.sec researchers to help companies with security issues (or am I being woefu

by rasur 12y ago

There should be some kind of anonymizing escrow-type service that allows people/info.sec researchers to help companies with security issues (or am I being woefully slow, and there already exists such a thing? This was just a OTTOMH/knee-jerk thought, FFTTMTFO..).

DanBC 12y ago
And it would help explain why the disclosure is being made - to help the company the disclosure is being made to, as a free gift.
- rasur 12y ago
  Yup, agreed. I wasn't clear, but I was thinking/ass-u-me'ing that it would be an entity that would try to act responsibly.
oliwary 12y ago
Maybe even a government agency? It could notify the company, follow up on whether they fixed the issue and sanction it if nothing has happened. Then it would allow the researcher to publish an article and protect him from retribution.
- nitrogen 12y ago
  The worry there is that such an agency might keep the exploits for itself.
giardini 12y ago
A lawyer can do this. But then _you_ must pay.