Do we mean different things by FD? Would you say we're not FD because researchers are incentivized to collaborate privately with companies to resolve vulnerabilities?
What I'd say is that today, few people bat an eyelash if a researcher does a detailed writeup of how a vulnerability and its exploit work (for instance, look at the Google security blog). That wasn't true in the 1990s: if a company of Google's stature had published something like that, it would have been controversial and newsworthy.
I'd suggest FD prevailed because it's relatively safe to publish vulnerabilities today; in fact, it's a career booster.
During the FD debate, there were "important" people suggesting that all vulnerabilities be routed to organizations like CERT, which had as a charter the concealment of vulnerability details.
Re:The Fall of Hacker Groups
by tedunangst on Thursday December 11, 2014 @11:35AM
(#8735647)
OK. I think full disclosure isn't quite the norm. More like "FD is tolerated" than "FD prevailed". Project Zero is kind of remarkable. But I suspect we're putting different emphasis on the word full.
Can you expand on this? I'd say the outcome has been the opposite of the foregone conclusion, unless I've misinterpreted you. FD seemed like the "of course it's this way" option (unless I misremember), but that's not where we are today.