6 ms·

No, it's called Responsible disclosure. https://security.stackexchange.com/questions/52/how-to-disclose-a-security-vulnerability-in-an-ethical-fashion https://s

No, it's called Responsible disclosure. https://security.stackexchange.com/questions/52/how-to-disclose-a-security-vulnerability-in-an-ethical-fashion https://security.stackexchange.com/questions/52/how-to-discl... By not contacting the developer first, you're acting in bad faith. This opens you up to all kinds of legal liabilities, not to mention the social exclusion that will occur.

ryanlol 7y ago
Nonsense. “Responsible disclosure” is a term coined by vendors to shame researchers who don’t play ball. There’s no implicit “bad faith” in full disclosure or even the sale of weaponized 0day exploits.
- effie 7y ago
  Oh this trope again. I am no vendor and I fully support the idea that security researchers coordinate their publication activities with affected parties.
  - ryanlol 7y ago
    Great, me too. But I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Charity is nice, but I’m not going to insist that you donate your whole paycheck!
    - Majromax 7y ago
      > I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Do you want ham-fisted regulations? Because that's how you get ham-fisted regulations. Lawmakers analogize. All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service announcements to justify criminalizing third-party security research (or the resulting disclosures).
      - mindslight 7y ago
        > All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service announcements It doesn't even take that much - throwing around terms like "bad faith" and "legal liabilities" suffices to create a hostile legal regime through common law torts. I'm okay with socially condemning unilateral disclosure as a likely assholeish thing to do, as long as we acknowledge that being an asshole is perfectly legal. I'm admittedly not up to speed on this particular soap opera, but it seems like the real blameful parties here are Gizmodo et al - scraping the bottom of the barrel for raw technical tidbits, and then escalating them into sensationalist "news" narrative rather than performing any sort of responsible interpretation.
  - deleted 7y ago
    [deleted]

ryanlol 7y ago

Nonsense. “Responsible disclosure” is a term coined by vendors to shame researchers who don’t play ball. There’s no implicit “bad faith” in full disclosure or even the sale of weaponized 0day exploits.

effie 7y ago
Oh this trope again. I am no vendor and I fully support the idea that security researchers coordinate their publication activities with affected parties.
- ryanlol 7y ago
  Great, me too. But I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Charity is nice, but I’m not going to insist that you donate your whole paycheck!
  - Majromax 7y ago
    > I also fully support the idea that people should be allowed to do whatever the fuck they want with their work product. (within the limits of the law, of course) Do you want ham-fisted regulations? Because that's how you get ham-fisted regulations. Lawmakers analogize. All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service announcements to justify criminalizing third-party security research (or the resulting disclosures).
    - mindslight 7y ago
      > All it takes is for some bright representative to think that "vulnerability disclosures" are more akin to "burglary tools" than to public service announcements It doesn't even take that much - throwing around terms like "bad faith" and "legal liabilities" suffices to create a hostile legal regime through common law torts. I'm okay with socially condemning unilateral disclosure as a likely assholeish thing to do, as long as we acknowledge that being an asshole is perfectly legal. I'm admittedly not up to speed on this particular soap opera, but it seems like the real blameful parties here are Gizmodo et al - scraping the bottom of the barrel for raw technical tidbits, and then escalating them into sensationalist "news" narrative rather than performing any sort of responsible interpretation.
- deleted 7y ago
  [deleted]