Responsible Disclosure Policy

Post by freehunter » Mon, Mar 05, 2012, 12:30 PM UTC

bmj wrote: post #41

freehunter wrote: post #30

Earlier quoted context omitted.

Actually, the world _does_ stop turning because it's Sunday. Anything happening on the weekend is emergency management, which takes time to scramble. I work in network/information security, and if we had a security incident on a Sunday, it would go to our backup team (of one). If they (he) deemed it critical, they would notify the security director, who would notify my boss, who would notify the rest of the team. Thi…

I agree. But we're talking about software as a service here, and that kinda makes it a different ballgame. Folks are paying money (in some cases) to use your software living on your servers (or, at least servers that you manage). I would certainly hope that someone who can deal with outages or penetrations is actually working on the weekend (perhaps that person doesn't work Monday and Tuesday?). Would you say "eh, bu…

Post by freehunter » Mon, Mar 05, 2012, 2:32 PM UTC

davyjones wrote: post #37

freehunter wrote: post #30

Earlier quoted context omitted.

Actually, the world _does_ stop turning because it's Sunday. Anything happening on the weekend is emergency management, which takes time to scramble. I work in network/information security, and if we had a security incident on a Sunday, it would go to our backup team (of one). If they (he) deemed it critical, they would notify the security director, who would notify my boss, who would notify the rest of the team. Thi…

> Actually, the world _does_ stop turning because it's Sunday. Incorrect. In Islamic countries, which are a part of this world, like Saudi Arabia and Oman have Thu-Fri weekend. http://en.wikipedia.org/wiki/Workweek_and_weekend#Islamic_co...

Post by Karunamon » Mon, Mar 05, 2012, 4:04 PM UTC

ig1 wrote: post #70

What the guy did was not only morally irresponsible but also criminal. The security community has long has an accepted standard of responsible disclosure, which involves informing the vulnerable party beforehand and allowing them time to fix the problem before publicly disclosing it. Publishing a vulnerability before giving those vulnerable a chance to fix it is irresponsible, using it to compromise a system is crimi…

Post by simonbrown » Mon, Mar 05, 2012, 4:45 PM UTC

gbrindisi wrote: post #68

rflrob wrote: post #32

Earlier quoted context omitted.

If what you're implying here is that they should be offering a bounty for discovery of bugs, I'm not necessarily disagreeing with you, but to expect them to get a policy about that and to allocate funding for those bounties on a Sunday, within 24 hours of a major, public breach seems a little unreasonable.

I'm with you but still it's silly they didn't have a responsible disclosure program until today in the first place.

Post by ig1 » Mon, Mar 05, 2012, 4:56 PM UTC

Karunamon wrote: post #75

ig1 wrote: post #70

What the guy did was not only morally irresponsible but also criminal. The security community has long has an accepted standard of responsible disclosure, which involves informing the vulnerable party beforehand and allowing them time to fix the problem before publicly disclosing it. Publishing a vulnerability before giving those vulnerable a chance to fix it is irresponsible, using it to compromise a system is crimi…

>the compromise of an account not held by him puts him clearly into the "black-hat" category. That's not what "black-hat" means.