I disagree - companies _can_ get this right. That's what Jon Lasser is talking about - guidelines for responsible release of vulnerability information.

If a vulnerability is found for the first time by a "white hat", the responsible thing for her (or him) to do is to inform the vendor of the software, then give them a reasonable time to solve the problem before going public. As Jon said, this is especially true if a lot of people depend on the software, and no known exploit exists for the vulnerability.

As an alternative, go public saying that "there is a problem in XXX software; we have notified the vendor". That way, people that don't depend on the software have the option of removing it from their system, or otherwise protect themselves. Theo de Radt handled the OpenSSH issue well this way.

Provide patches to them if you like. But don't assume that you know what it takes to write secure code, and release it on your own. That's not only arrogant, that's stupid. The vendor usually knows better.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/91/13327#13327