Re:The Fall of Hacker Groups
by tedunangst on Thursday December 11, 2014 @11:35AM
(#8735647)
OK. I think full disclosure isn't quite the norm. More like "FD is tolerated" than "FD prevailed". Project Zero is kind of remarkable. But I suspect we're putting different emphasis on the word full.
What I'd say is that today, few people bat an eyelash if a researcher does a detailed writeup of how a vulnerability and its exploit work (for instance, look at the Google security blog). That wasn't true in the 1990s: if a company of Google's stature had published something like that, it would have been controversial and newsworthy.
I'd suggest FD prevailed because it's relatively safe to publish vulnerabilities today; in fact, it's a career booster.
During the FD debate, there were "important" people suggesting that all vulnerabilities be routed to organizations like CERT, which had as a charter the concealment of vulnerability details.