Mark Rasch, 2002-03-11
A proposed Internet standard would dictate how researchers report and vendors close security vulnerabilities. Ignoring it could be risky for either side.
Colapse all |
Post comment
'Responsible Disclosure' Draft Could Have Legal Muscle
2002-03-12
Coldman (1 replies)
Coldman (1 replies)
> "official Internet standard, called an "RFC"
Internet standards are named STD, not RFC.
RFC is "Request for comments" and nothing more, unless widely accepted/recognized as standard. Publishing a RFC won't make it standard by itself....
[ more ] [ reply ]
Internet standards are named STD, not RFC.
RFC is "Request for comments" and nothing more, unless widely accepted/recognized as standard. Publishing a RFC won't make it standard by itself....
[ more ] [ reply ]
Not all RFCs are standards (see RFC 1796)
2002-03-13
Dwonis (1 replies)
Dwonis (1 replies)
'Responsible Disclosure' Draft Could Have Legal Muscle
2002-03-16
Keith
Keith
In fact people can be held legally liable with or without a technical standard on disclosure, in any virtually jurisdiction worldwide.
Even an unsuccessful lawsuit can punish the respondent (defendant) because of the costs involved in defending him/herself.
A standard on disclosure would do m...
[ more ] [ reply ]
Even an unsuccessful lawsuit can punish the respondent (defendant) because of the costs involved in defending him/herself.
A standard on disclosure would do m...
[ more ] [ reply ]
Grace Hopper and Liability
2002-03-22
J.R.
J.R.
Back in the early 80's I had the privledge of listening to a presentation by Grace Hopper. Besides the normal modules of her presention regarding need for growth and where she saw the DP world heading, she addressed the issue of the potential damage of bad code or poorly Q.C.'ed code. Her observat...
[ more ] [ reply ]
[ more ] [ reply ]
Some good points, but too legalistic.
2002-03-22
Anonymous
Anonymous
The characterization of the responsible disclosure protocol in this
piece goes well beyond the intent of the Internet Draft itself. There is
a world of difference between an informal guideline that will serve both
the security research and software development communities, as a
tool, and the kin...
[ more ] [ reply ]
piece goes well beyond the intent of the Internet Draft itself. There is
a world of difference between an informal guideline that will serve both
the security research and software development communities, as a
tool, and the kin...
[ more ] [ reply ]
1. http://online.securityfocus.com/guest/10711
2. http://www.ietf.org/internet-drafts/draft-christey-wysopal-v
uln-disclosure-00.txt...
[ more ] [ reply ]