[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BN4PR11MB0882BF16C0E31311122387B9AAE00@BN4PR11MB0882.namprd11.prod.outlook.com>
Date: Fri, 26 Jan 2018 17:48:14 +0000
From: Mikhail Utin <mikhailutin@...mail.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: How to deal with reporters who don't want their
bugs fixed?
I 100% agree with Solar's response. We should not limit our freedom to choose how we will handle our intellectual property. That is how I read the original statements below.
Not to cause more discussion, but here is the example of how "universal ethics" work:
https://www.theregister.co.uk/2018/01/25/intel_spectre_disclosed_flaws_november/
Mikhail Utin, CISSP
________________________________
From: Solar Designer <solar@...nwall.com>
Sent: Friday, January 26, 2018 12:16
To: oss-security@...ts.openwall.com
Subject: Re: [oss-security] How to deal with reporters who don't want their bugs fixed?
On Fri, Jan 26, 2018 at 10:23:49AM -0500, Stiepan wrote:
> I think that clear rules might be welcome:
I agree (specifically, I had suggested explicit maximum embargo times),
but such rules must not be one and only industry standard. Anyone or
any project may propose rules, and other projects are welcome to reuse
those rules, but they must not have to - they could as well use
different rules, or none. At best, a relatively non-controversial
and brief boilerplate could end up being reused by many projects.
> We as a profession should have a clear code of ethics
No. Let's not use the word ethics. That word, except when explicitly
referring to a particular person's or group's ethics, implies that when
we (dis)agree or are judging others, we claim to be necessarily right -
but in reality we're necessarily subjective.
This would be just as flawed a concept/term as "responsible disclosure".
(I refrain from using that term as well, except when pointing out just
how unnecessarily judgemental it is - implying that other kinds of
disclosure would have been "irresponsible" - but we're subjective.)
> universal ethics' code
That's an oxymoron. No such thing can possibly exist.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
