News for hackers. Stuff that matters.
Re:Ridiculous vulnerability disclosure process with CrowdStr... by monocasa on Monday August 22, 2022 @06:14PM (#32557977)
The use of 'responsible' wrt vulnerability disclosure is thought to at least go back to 2001's essay "It’s Time to End Information Anarchy", and I know that the adjective 'responsible' was being thrown around wrt vulnarability disclosure before that. @stake did not invent the term in the early aughts. https://web.archive.org/web/20011109045330if_/http://www.mic...

Yes, CERT has moved using CVD, but I argue that's because of their conservationism. They don't want to rock the boat and tend towards vendor friendly, neutral language. That makes sense for their niche.

And just throwing it out there that the older term that's actively being erased because its implications are unfriendly to entrenched interests isn't the "Orwellian" one.

Re:Ridiculous vulnerability disclosure process with CrowdStr... by tptacek on Monday August 22, 2022 @06:30PM (#32558105)
I'm sorry, but I think you're just kind of making things up here to perpetuate an unproductive argument. By "conservative", I meant that CERT is broadly anti-disclosure in all forms, which I think is a claim that pretty much anyone working in vulnerability research would recognize.

Here's the 2002 I-D that Weld worked on with Steve Christey standardizing the term. It's notable for being roughly contemporaneous with @stake firing Dan Geer over, as I recall, somehow alienating Microsoft, one of @stake's larger clients.

https://cve.mitre.org/data/board/archives/2002-02/msg00026.h...

Your link, for what it's worth, doesn't use the term at all. But even if it had, it wouldn't change anything.

Just to keep this on track: your claim was that "Coordinated Disclosure" --- the near-universal standard term for what used to be called "Responsible Disclosure" --- is an "Orwellian re-imagining". Leaving aside the fact that there's nothing intrinsically "Orwellian" about renaming something, the fact remains: "Responsible Disclosure" was researcher-hostile and patronizing, and has been chucked out the window by almost everybody who matters in vulnerability research.

We've managed to hash out a hot topic from, like, 2012 on this thread, which is great, it's progress, we move forward bit by bit here on HN, just like Joel Spolsky once said; "fire and motion". But we can probably be done now.