Re: [Security] [vendor-sec] Re: [Full-Disclosure] Re: Vulnerability Disclosure Debate

[Seth Arnold <sarnold@wirex.com>]

On Sat, Aug 09, 2003 at 12:49:25PM +0300, Georgi Guninski wrote:
> Steven M. Christey wrote:
> >Whether open source organizations are a formal part of OIS or not, at
> >least some of them are advocating some form of "responsible"

For my own part, I -really- like rain.forest.puppy's RFPolicy; it is
very simple to understand for everyone involved, and it seems to work
better than just throwing bug information into the wind.

The only way anyone is going to take part in "responsible disclosure" is
if it is (a) easy (b) gives credit where credit is due. I think RFPolicy
goes a long way towards satisfying both points, but has the downside
that it is not "blessed" by a formal organization, thus many large
companies aren't likely to promote it.

I think people generally -want- to do The Right Thing, but reading more
than a page to figure out what the right thing -is- is likely to be a
disincentive towards doing the right thing.

-- 
"Dependence on computers is apparently making a significant fraction
of the population incurably stupid." -- Fritz Whittington

PGP signature