[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <OF76307389.CF3EA523-ONC125821D.0037F12D-C125821D.003B74CE@avm.de>
Date: Mon, 22 Jan 2018 11:49:25 +0100
From: r.hering@....de
To: oss-security@...ts.openwall.com
Subject: Re: How to deal with reporters who don't want their bugs
fixed?
Point is, many "security researchers" overly pretend to work for security
hiding intention for fame / paper publications / product selling.
Accept unnecessary long embargoes then you support this behaviour but
might provide patches faster after public release.
Reject unnecessary long embargoes then you discourage this behaviour but
might provide patches slower after public release next time.
I think the decision is always individual per vulnerability weighting how
grave/easy to find/abuse it is vs. how interested you are in future early
reports.
Keeping it individual without public announced maximum embargo time would
also help prevent folks from jumping to 0daying everything per default:)
(°X|
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
