Re:Ridiculous vulnerability disclosure process with CrowdStr...
by monocasa on Monday August 22, 2022 @05:51PM
(#32557756)
He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft.
And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays.
Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
Re:Ridiculous vulnerability disclosure process with CrowdStr...
by tptacek on Monday August 22, 2022 @06:08PM
(#32557921)
I simply don't care what Peter Bright says, and neither does anybody else in the field. We're now arguing for the sake of arguing. It's plainly correct that the term "Responsible Disclosure" is disfavored, and disfavored for the reasons I say it is. I didn't come up with any of these things; I just work in vulnerability research (or used to) and know what the stories are.
Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.