The problem is not getting grey hats to contribute, it is getting companies to be responsible for responding. Sure, most of the vulnerabilities are known, and you need good rules to define when someone gets a bounty. Also, the system should allow for simple "credit" or even just compensation for costs and expenses for those who are, shall we say, lighter shades of grey. Of course the vendors and users will claim that they knew about the problem all along -- but this is also partially a PR thing for them as well.

Who knows... it's at least worth exploring. I am contantly asked by grey hats "how do I tell xxxx about this vulnerability?" We need an effective mechanism.

MDR

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/197/23666#23666