4 ms·
Although I take your point of principle, I'm not really sure I see any incentive to not share vulns. From what I can think, the options are: 1) Actively exploi
by CHY872 11y ago
Although I take your point of principle, I'm not really sure I see any incentive to not share vulns. From what I can think, the options are:
1) Actively exploit - I think we can agree that providing it to someone who will actively exploit is ethically dubious, or at least can be classified as irresponsible?
2) Share with the vendor. Ethically, this is fine.
3) Do nothing with it. Ethically, this is fine, although pointless.
4) If you make software that's supposed to detect and/or block the use of such vulnerabilities, add it to the detection system. I don't think this is a 'good guy' thing to do, although I suppose it could in principle be what's best for the company.
Having said that, my guess is that this last one has the smallest amount of commercial value, since it turns what might be a few months of work into a tiny part of a bigger piece of software; it's an investment that probably ranges (when overheads are considered) from $5-50k that has no value at all unless someone else finds the same bug.
But if someone else finds the bug, they could as easily be another security researcher as a bad guy, and then you've kinda lost out.
Have I missed anything here?
- tptacek 11y agoIn this case we're not even talking about a vendor not getting access to a bug found by a third party (though that does happen). We're talking about a series of vendors notified ahead of time who now expect to have a say in how the researcher notifies others. The general response a lot of vuln researchers have to this kind of sniping is that it should be directed to the person who wrote code after, say, 1995 that directly edited /etc/passwd instead of rebuilding and linking it.