vulnerability disclosure

Three Minutes with Rain Forest Puppy (RFP interview by Zetter)

2001/09/28 : Here is a Rain Forest Puppy interview done by Kim Zetter about the RFPolicy.

In June 2000, the hacker Rain Forest Puppy published his RFPolicy. The policy is known as the first attempt to formalize the complex issue of disclosure to the vendor or maintainer....Read more

Is the iDefense challenge worth it? (Chickowski paper)

2006/02/23 : Ericka Chickowski writes upon iDefense rewards and their way of working with enterprises and hackers. 

This artifact is part of the iDefense Bundle...Read more

Threat Complexity Requires New Levels of Collaboration - Stone and Moussouris on the creation of MSVR

2008/08 : Microsoft create the Microsoft Vulnerability Research Program (MSVR).Read more

Schneier - Crypto-gram January 15, 2000

2000/01/15 - Schneier Crypto-Gram newsletter :
nCypher publically disclosed SSL private key vulnerabilities to sell their solution to fix the flaw. Schneier writes here his opinion against this practice. 

This article is part of the...Read more

TikTok Is Removing Educational Hacking Videos

2021/09/13 : Joseph Cox explains how TikTok removes several videos created for educational hacking purposes.Read more

How not to prove your election outcome (SwissPost voting system 2nd vuln reporte)

2019/03/25: Public vulnerability report in the SwissPost e-voting system. Explanation and proof of the vulnerability. This is the second report showing vulnerabilities in this e-voting system by the security researchers team of Sarah Jamie Lewis, Vanessa Teague, and Olivier Pereira.

...Read more

Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels

EFAIL Usenix paper, released (in a draft version) on may 14, 2018 due to embargo break. It describes the EFAIL attacks (technique: malleability gadgets) to reveal plaintext of emails encrypted with S/MIME and OpenPGP.Read more

United Airlines bug bounty

2015 : United Airlines launched its bug bounty program.Read more
Three iOS 0-days revealed by researcher frustrated with Apple’s bug bounty

2021/09/24 (in ArsTechnica) : Ethical hackers are fed up with the inefficiency of Apple's bug bounty program. This is how three iOS 0-days were revealed by researcher frustrated. Jim Salter explains the situation.

This artifact is part of the ...Read more

Ultimate guide to Vulnerability disclosure - 2021 (Bugcrowd)

2021/12 : "This reports examines :
The strategic, legal, and social nuances associated with vulnerabilities discovered “in the wild”
...Read more

Subscribe to vulnerability disclosure