Responsible Disclosure Debate
The cluster centers on debates about responsible disclosure practices for security vulnerabilities, including its ethics, necessity, definitions, and whether public announcements before patches aid or harm security.
Activity Over Time
Top Contributors
Keywords
Sample Comments
The right thing to do is follow Responsible Disclosurehttps://www.bugcrowd.com/resource/what-is-responsible-disclo...
How is disclosing critical security vulnerabilities responsibly a bad thing, again?
Would this not defeat the purpose of responsible disclosure? As a bad actor I could learn of secret vulnerabilities from this channel.
that would have been a withholder, not disclosure. you need to disclose the vulnerability to those who are vulnerable for it to be disclosure, and nothing else is responsible.
Further evidence that "responsible disclosure" is not responsible.
What ethical issue do you see? What is there to responsibly disclose? Software vendors do this on purpose; they don't need notification.
Is responsible disclosure not a thing anymore?
isn't this kind of stuff subject to responsible disclosure?
Responsible disclosure, anyone?
Responsible disclosure exists in order to allow an obscure, previously undiscovered bug to be patched before others know about it. The idea is that no one else is likely to discover the issue while it is repaired.This is not an obscure bug. This is obvious -- very obvious. Many people will have discovered this already. Furthermore this is a pre-release product.There is nothing to be gained by not talking about it.