| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20030811192300.GC29165@wirex.com> From: sarnold at wirex.com (Seth Arnold) Subject: [Security] [vendor-sec] Re: Re: Vulnerability Disclosure Debate On Sat, Aug 09, 2003 at 12:49:25PM +0300, Georgi Guninski wrote: > Steven M. Christey wrote: > >Whether open source organizations are a formal part of OIS or not, at > >least some of them are advocating some form of "responsible" For my own part, I -really- like rain.forest.puppy's RFPolicy; it is very simple to understand for everyone involved, and it seems to work better than just throwing bug information into the wind. The only way anyone is going to take part in "responsible disclosure" is if it is (a) easy (b) gives credit where credit is due. I think RFPolicy goes a long way towards satisfying both points, but has the downside that it is not "blessed" by a formal organization, thus many large companies aren't likely to promote it. I think people generally -want- to do The Right Thing, but reading more than a page to figure out what the right thing -is- is likely to be a disincentive towards doing the right thing. -- "Dependence on computers is apparently making a significant fraction of the population incurably stupid." -- Fritz Whittington -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 240 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030811/aacb726f/attachment.bin
Powered by blists - more mailing lists