Re:Microsoft Offers Bug Bounty to Prevent Another Spectre-Me...
by baddox on Saturday March 17, 2018 @11:42PM
(#16610380)
If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to notify the vendor privately, then disclose publicly after some period of time if the vendor is uninterested or unresponsive, with the idea being that it’s safer in the long run for vulnerabilities to be publicly known than only known to a small number of parties (since some of those parties may be trying to exploit the vulnerability).
Re:Microsoft Offers Bug Bounty to Prevent Another Spectre-Me...
by dspillett on Sunday March 18, 2018 @04:58AM
(#16611044)
> If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly?
Because of the public?
If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?
Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it.
It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.