vulnerability disclosure debate

CERT to disclose software flaws - Lemos paper

2000/10/09 : Lemos give his point of view on vulnerability disclosure debate.
"While Ranum is well-known in the industry for his black-and-white views on disclosure, most security professionals fall into a grey area."


This artefact is part of...Read more

ImageShack hacked in oddball security protest (anti-sec movement)

2009/07/13 : John Leyden explains how "Anti-Sec" broke into the big image hosting websites ImageShack.

This artifact is part of the Anti-Sec movement Bundle...Read more

THE PRICE OF RESTRICTING VULNERABILITY PUBLICATIONS (Granick Article)

2005 : "Part One of this paper explains the current state of computer (in)security and sets forth three ways to restrict publications followed by the most common arguments for and against. It then illustrates the popularity of security publication restrictions with an ...Read more

Security in an Open Electronic Society - Levy reaction on Culp essay

2001/10/21 : Levy gives his point of view on Culp essay : "It appears Culp is more comfortable with an 'information dictatorship' or 'information oligarchy' model, and has entirely missed the fact that the movie house ...Read more

White-Hat Hate Crimes on the Rise (Wired Paper)

2001 : "A group of black-hat hackers, in a campaign called "Project Mayhem," have declared war on white-hat hackers who've gone to work for security firms."
The 'Project Mayhem' is the battle declaration of full-disclosure against anti-sec.
Read more

Bug Bounty Programs Are Being Used to Buy Silence - Schneier Post

2020/04/03 : Bruce Schneier writes on the "Investigative report [by J.M. Porup] on how commercial bug-bounty programs like HackerOne, Bugcrowd, and SynAck are being used to silence researchers".

To read Porup report : ...Read more

Schneier - Crypto-Gram February 15, 2003

2003/02/15 : Schneier published his monthly newsletter.
He talks this time on Locksmiths.

"This position ignores the fact that public scrutiny is the only reliable way to improve security....Read more

Information Anarchy: The Blame Game? - Edwards reaction on Culp essay

2001/10/23 : Edwards analyses Culp essay on information anarchy.

"It seems that Microsoft is doing that now indirectly with its new Strategic Technology Protection Program (STPP). The effects should...Read more

The realities of Disclosure : Morgenstern and Parker on Christey and Wysopal failure

2002/07/12 : Michael Morgenstern and Tom Parker point to the failure of Christey and Wysopal's willingness to put in place common measures for responsible disclosure.

"Unfortunately, Steve Christey and Chris Wysopol's RFC of February...Read more

Software Vulnerabilities: Full-, Responsible-, and Non-Disclosure - (Cencini, Yu and Chan publication)

2005/12/07 : Andrew Cencini, Kevin Yu, Tony Chan write upon the different choices of vulnerability disclosures.

"When a software vulnerability is discovered by a third party, the complex question of who, what...Read more

Subscribe to vulnerability disclosure debate