Re: How to deal with reporters who don't want their bugs fixed?

[Kurt Seifried <kseifried () redhat com>]

On Thu, Jan 18, 2018 at 9:10 AM, Florian Weimer <fweimer () redhat com> wrote:
> Subject says it all: What do you do if you receive a vulnerability report,
> and the reporter requests an embargo at some time in the future because
> that's when their paper/conference presentation/patent submission is
> scheduled?

We (Red Hat) respect the embargo request (although we will often try
to negotiate something a bit more sensible if they make a really
awkward request), but ultimately we want the researchers to come to
us, if we annoy them to much they might stop coming to us and just
drop their results as a 0day at the conference with no heads up.

> The obvious approach is to find a prior public report of essentially the
> same bug and fix that (which will work surprisingly often), but let's assume
> that this isn't the case.

I'm not sure this is a sustainable approach as researchers who want to
make a name for themselves are faced with the "well if I tell them,
they'll try to ignore my embargo request" which incentivizes them to
not do a coordinated disclosure.

> Thanks,
> Florian



-- 

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com