full-disclosure - Disclosure timelines from vendors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Dec 14 19:36:05 2005
From: coley at mitre.org (Steven M. Christey)
Subject: Disclosure timelines from vendors - a promising
	practice?

I was just browsing the Red Hat bug report for the mod_imap XSS issue
(CVE-2005-3352).

In it, they included a disclosure timeline (possibly from Apache, this
is not clear).

I've only seen a handful of disclosure timelines by a vendor.  But in
my opinion, it should be more widely adopted by those who want to
assure their customers that they respond quickly to vulnerabilities.
A vendor who responds quickly and effectively to security reports
would want to "advertise" this fact, I would think.

In this particular case, the timeline shows that the Apache Software
Foundation was ready to coordinate on a release shortly after initial
notification, but there were additional delays due to a coordination
breakdown.

Recently, large-scale comparative analyses on vulnerabilities have
emphasized the publication-to-patch portion of the disclosure window.
But the "known window of exposure" is actually notification-to-patch,
which can be much longer.  Most top researchers include timelines that
would help provide this data, but it would be great to see more of
this from vendors.

- Steve

P.S.  In general, disclosure timelines can make interesting reading.
They are highly informative about the twists and turns of the
disclosure process.