mailing list archives
Re: Publicly Disclosing A Vulnerability
From: Steve Friedl <steve () unixwiz net>
Date: Wed, 5 Oct 2005 08:17:41 -0700
On Wed, Oct 05, 2005 at 09:52:14AM -0500, Josh Perrymon wrote:
Well... I called the company up and got the lead engineer on
the phone.. He seemed a little pissed.
This seems to be a common vendor response: yuck.
So I ask the list- what is more beneficial to the customer? Not publicly
disclosing the risk and hoping that they follow the suggestions of the
vendor to upgrade? Or waiting 30 days and send it out?
If the vendor knows which customer you're doing the work for, it's not
really your call to make.
Your customer still has to work with the vendor after you're gone, and
going public - which I think is a fine idea in general - could sour a
relationship that's not yours to sour. Ask the customer what they want
to do with this, but if you're covered under NDA (as you surely must be)
I'm pretty sure you have to sit on it if they tell you to.
This is a customer-service issue, not a security issue. And a bummer.
Stephen J Friedl | Security Consultant | UNIX Wizard | +1 714 544-6561
www.unixwiz.net | Tustin, Calif. USA | Microsoft MVP | steve () unixwiz net
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/