3 ms·
>Responsible disclosure is intended to be ethical, the opposite is ... well, irresponsible. It turns out the name was chosen for its connotations, i.e. to soun
by davidgerard 11y ago
>Responsible disclosure is intended to be ethical, the opposite is ... well, irresponsible.
It turns out the name was chosen for its connotations, i.e. to sound good. If you call it "coordinated disclosure" it doesn't come into the discussion cheating.
- mpdehaan2 11y agoThe points stand on their own, and I think it's useful to have a phrase that markets the practice. I personally view it as irresponsible regardless of whether we called it "Foo Disclosure". I do view sharing the exploit on the patch date irresponsible irrespective of the term. I believe the name was chosen well, and I don't think it deserves painting with "PATRIOT ACT" type brush. I've dealt with commercial firms as well as non-commercial firm disclosures, and really working with people who report security issues could go a LOT smoother. A lot of those experiences did not go well, but it would be wrong for me to make generalizations. Business here on either side doesn't matter; the user is all that matters, and it shouldn't be about getting "credit", earning points, or being done with something quickly. I think a lot of people think this is a game or something, and it's really not. Real systems and real people's data are on the line.