Heartbleed disclosure timeline: who knew what and when

Re:Heartbleed disclosure timeline: who knew what and when by ithinkso on Monday April 14, 2014 @08:30PM (#7589700)

I wonder how one should proceed (if not working for any of this big tech companies) when one discover as critical bug as heartbleed?

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by danielweber on Tuesday April 15, 2014 @09:33AM (#7591677)

1. Keep a timeline.

2. Ask to speak to a representative of the people developing the thing on the telephone.

3. Between the two of you, figure out who to tell next.

4. Realize that other people may find the bug, too. You have some time, but not infinite time.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by asperous on Monday April 14, 2014 @09:35PM (#7589864)

It's only fair to publicly disclose immediately. You can't possibly alert every trustworthy company on earth.

Now, if you want a bug bounty, you have to file a report and wait a certain amount of time before you are allowed to disclose.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by baby on Monday April 14, 2014 @10:05PM (#7589955)

You don't want to disclose it before releasing a patch.

[ Parent | on HN ]