Date: Fri, 26 Jan 2018 18:16:24 +0100 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: How to deal with reporters who don't want their bugs fixed? On Fri, Jan 26, 2018 at 10:23:49AM -0500, Stiepan wrote: > I think that clear rules might be welcome: I agree (specifically, I had suggested explicit maximum embargo times), but such rules must not be one and only industry standard. Anyone or any project may propose rules, and other projects are welcome to reuse those rules, but they must not have to - they could as well use different rules, or none. At best, a relatively non-controversial and brief boilerplate could end up being reused by many projects. > We as a profession should have a clear code of ethics No. Let's not use the word ethics. That word, except when explicitly referring to a particular person's or group's ethics, implies that when we (dis)agree or are judging others, we claim to be necessarily right - but in reality we're necessarily subjective. This would be just as flawed a concept/term as "responsible disclosure". (I refrain from using that term as well, except when pointing out just how unnecessarily judgemental it is - implying that other kinds of disclosure would have been "irresponsible" - but we're subjective.) > universal ethics' code That's an oxymoron. No such thing can possibly exist. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ