A *limited* non-disclosure period is a good idea, and academic researchers will do this, though Ross Anderson (http://www.cl.cam.ac.uk/users/rja14/) of Cambridge University once disclosed a serious security bug to a financial institution, which couldn't decide which department was responsible for it by the time he eventaully released it!

Commercial researchers should be able to find a way to charge for information on a delayed publication model.

What is needed for all parties (excluding attackers and lazy vendors) is a chance to fix the problem and an incentive to fix it promptly - 30 days from notification to publication sounds plausible.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/5458/20416#20416