That is one of the most well-balanced articles on vulnerabilities that I have read in a long time. It is a balancing act but vendors are the source / cause of the vulnerabilities. While totally irresponsible disclosure practices on the part of the security "researcher" are worthy of bad press, vendors have to start owning up to the ultimate responsibility. Giving a vendor 2 days before "going public" is a pointless threat that hurts everybody. But giving a vendor 6 months is just as bad.

I agree that rewards are not a bad thing - maybe if vendors allowed their own internal testing staff (if they actually even have any?) to seek reward bonuses for finding vulnerabilities we'd have fewer found after the release of the software.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/391/33327#33327