I completely disagree with the idea that vulnerability information should be auctioned off, because if this flaw is not picked up by the software vendor and does fall into the wrong hands, then many "innocent" users are to suffer.

On the contrary to this I believe that software vendors should be VERY heavily fined for each vulnerability exposed. (With a good portion of this fine going to the researcher who discovered it.) This would mean the incentive was directly linked to where it counts....finance. At the same time there is less risk of information on a Vulnerability falling into dangerous hands.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11364/32891#32891