Re: How to deal with reporters who don't want their bugs fixed?

[Mikhail Utin <mikhailutin () hotmail com>]

 r.hering () avm de <r.hering () avm de> wrote:


Keeping it individual without public announced maximum embargo time would
also help prevent folks from jumping to 0daying everything per default:)


However, to me it is pure "Security by Obscurity" in a bit different wording. It never worked. Simply think that 
somebody else knows the secret and with your help continues using that.


"hiding intention for fame / paper publications / product selling" Hiding is not good. We are not monks and Security is 
not our God. Things like publications and selling require time and actually help to move things forward.


Mikhail Utin, CISSP


________________________________
From: r.hering () avm de <r.hering () avm de>
Sent: Monday, January 22, 2018 05:49
To: oss-security () lists openwall com
Subject: Re: [oss-security] How to deal with reporters who don't want their bugs fixed?

Point is, many "security researchers" overly pretend to work for security
hiding intention for fame / paper publications / product selling.

Accept unnecessary long embargoes then you support this behaviour but
might provide patches faster after public release.
Reject unnecessary long embargoes then you discourage this behaviour but
might provide patches slower after public release next time.

I think the decision is always individual per vulnerability weighting how
grave/easy to find/abuse it is vs. how interested you are in future early
reports.
Keeping it individual without public announced maximum embargo time would
also help prevent folks from jumping to 0daying everything per default:)

(°X|