Well I think both the vendor and the researcher are partly at fault. In a circumstance, this happens alot it seems, where the vendor is contacted by the researcher about a new vulnerability and exploit, and the vendor does nothing at all...the researchers best next move is to make the vulnerability public to the general public, that way atleast people that look on sites like securityfocus, and other vulnerability databases etc, will have a heads up...and then of course the not security minded people are pretty screwed, but regardless...the general public should get some info on a vulnerability before you just let the exploit go flying around on the internet, its not the users fault that the vendor made the software insecure.

basically what i'm saying is, add a couple extra steps to notify the users and the public about the problem before you publish code and allow users that have no idea there is a vulnerability, to get owned.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/391/33297#33297