> And, to clarify, I'm not saying that posting an exploit to Bugtraq before even contacting a vendor (or perhaps, just a few hours after contacting them) is responsible. It's not.

End users of publicly available applications are telling us that they want to be notified at the same time as vendors. If they are using vulnerable software, they would rather know their risks than be in the dark. That's why they are paying money to be part of vulnerability notification services.

The only people I've seen to vocally advocate "responsible disclosure" are either employees of corporations who publish software, or passive observers who don't do security research. This dialog should really be between the active participants; the end-users and the researchers. Everyone else in irrelevant.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/391/33270#33270