Date: Thu, 18 Jan 2018 09:51:37 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: How to deal with reporters who don't want their bugs fixed? On Thu, Jan 18, 2018 at 9:10 AM, Florian Weimer <fweimer@...hat.com> wrote: > Subject says it all: What do you do if you receive a vulnerability report, > and the reporter requests an embargo at some time in the future because > that's when their paper/conference presentation/patent submission is > scheduled? We (Red Hat) respect the embargo request (although we will often try to negotiate something a bit more sensible if they make a really awkward request), but ultimately we want the researchers to come to us, if we annoy them to much they might stop coming to us and just drop their results as a 0day at the conference with no heads up. > The obvious approach is to find a prior public report of essentially the > same bug and fix that (which will work surprisingly often), but let's assume > that this isn't the case. I'm not sure this is a sustainable approach as researchers who want to make a name for themselves are faced with the "well if I tell them, they'll try to ignore my embargo request" which incentivizes them to not do a coordinated disclosure. > > Thanks, > Florian -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.