[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANO=Ty3XSnvLXmXuVmpKahoToTdYrMegKs6HeQSco3m9fK1udQ@mail.gmail.com>
Date: Thu, 18 Jan 2018 09:51:37 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: How to deal with reporters who don't want their
bugs fixed?
On Thu, Jan 18, 2018 at 9:10 AM, Florian Weimer <fweimer@...hat.com> wrote:
> Subject says it all: What do you do if you receive a vulnerability report,
> and the reporter requests an embargo at some time in the future because
> that's when their paper/conference presentation/patent submission is
> scheduled?
We (Red Hat) respect the embargo request (although we will often try
to negotiate something a bit more sensible if they make a really
awkward request), but ultimately we want the researchers to come to
us, if we annoy them to much they might stop coming to us and just
drop their results as a 0day at the conference with no heads up.
> The obvious approach is to find a prior public report of essentially the
> same bug and fix that (which will work surprisingly often), but let's assume
> that this isn't the case.
I'm not sure this is a sustainable approach as researchers who want to
make a name for themselves are faced with the "well if I tell them,
they'll try to ignore my embargo request" which incentivizes them to
not do a coordinated disclosure.
>
> Thanks,
> Florian
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
