oss-sec mailing list archives
Re: How to deal with reporters who don't want their bugs fixed?
From: Solar Designer <solar () openwall com>
Date: Fri, 26 Jan 2018 18:16:24 +0100
On Fri, Jan 26, 2018 at 10:23:49AM -0500, Stiepan wrote:
I think that clear rules might be welcome:
I agree (specifically, I had suggested explicit maximum embargo times), but such rules must not be one and only industry standard. Anyone or any project may propose rules, and other projects are welcome to reuse those rules, but they must not have to - they could as well use different rules, or none. At best, a relatively non-controversial and brief boilerplate could end up being reused by many projects.
We as a profession should have a clear code of ethics
No. Let's not use the word ethics. That word, except when explicitly referring to a particular person's or group's ethics, implies that when we (dis)agree or are judging others, we claim to be necessarily right - but in reality we're necessarily subjective. This would be just as flawed a concept/term as "responsible disclosure". (I refrain from using that term as well, except when pointing out just how unnecessarily judgemental it is - implying that other kinds of disclosure would have been "irresponsible" - but we're subjective.)
universal ethics' code
That's an oxymoron. No such thing can possibly exist. Alexander
Current thread:
- Re: How to deal with reporters who don't want their bugs fixed?, (continued)
- Re: How to deal with reporters who don't want their bugs fixed? Tavis Ormandy (Jan 20)
- Re: How to deal with reporters who don't want their bugs fixed? Florian Weimer (Jan 20)
- Re: How to deal with reporters who don't want their bugs fixed? r . hering (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Mikhail Utin (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Ian Zimmerman (Jan 22)
- Re: Re: How to deal with reporters who don't want their bugs fixed? Tristan Henning (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Stiepan (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Mikhail Utin (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? halfdog (Jan 27)
- Re: How to deal with reporters who don't want their bugs fixed? Stiepan (Jan 27)