oss-sec mailing list archives
Re: How to deal with reporters who don't want their bugs fixed?
From: Mikhail Utin <mikhailutin () hotmail com>
Date: Mon, 22 Jan 2018 17:20:36 +0000
r.hering () avm de <r.hering () avm de> wrote: Keeping it individual without public announced maximum embargo time would also help prevent folks from jumping to 0daying everything per default:) However, to me it is pure "Security by Obscurity" in a bit different wording. It never worked. Simply think that somebody else knows the secret and with your help continues using that. "hiding intention for fame / paper publications / product selling" Hiding is not good. We are not monks and Security is not our God. Things like publications and selling require time and actually help to move things forward. Mikhail Utin, CISSP ________________________________ From: r.hering () avm de <r.hering () avm de> Sent: Monday, January 22, 2018 05:49 To: oss-security () lists openwall com Subject: Re: [oss-security] How to deal with reporters who don't want their bugs fixed? Point is, many "security researchers" overly pretend to work for security hiding intention for fame / paper publications / product selling. Accept unnecessary long embargoes then you support this behaviour but might provide patches faster after public release. Reject unnecessary long embargoes then you discourage this behaviour but might provide patches slower after public release next time. I think the decision is always individual per vulnerability weighting how grave/easy to find/abuse it is vs. how interested you are in future early reports. Keeping it individual without public announced maximum embargo time would also help prevent folks from jumping to 0daying everything per default:) (°X|
Current thread:
- Re: How to deal with reporters who don't want their bugs fixed?, (continued)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 18)
- Re: How to deal with reporters who don't want their bugs fixed? Luedtke, Nicholas (Cyber Security) (Jan 18)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 18)
- Re: How to deal with reporters who don't want their bugs fixed? Nicholas Luedtke (Jan 19)
- Re: How to deal with reporters who don't want their bugs fixed? i (Jan 19)
- Re: How to deal with reporters who don't want their bugs fixed? Greg KH (Jan 19)
- Re: How to deal with reporters who don't want their bugs fixed? Igor Seletskiy (Jan 19)
- Re: How to deal with reporters who don't want their bugs fixed? Tavis Ormandy (Jan 20)
- Re: How to deal with reporters who don't want their bugs fixed? Luedtke, Nicholas (Cyber Security) (Jan 18)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 18)
- Re: How to deal with reporters who don't want their bugs fixed? r . hering (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Mikhail Utin (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Ian Zimmerman (Jan 22)
- Re: Re: How to deal with reporters who don't want their bugs fixed? Tristan Henning (Jan 22)
- Re: How to deal with reporters who don't want their bugs fixed? Stiepan (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Mikhail Utin (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? Solar Designer (Jan 26)
- Re: How to deal with reporters who don't want their bugs fixed? halfdog (Jan 27)