"Responsible disclosure" starts with "bug bounties". If you aren't paying people to discover vulns in your code, then any way the discoverer wants to disclose the vuln is "responsible".
In other words, "responsible disclosure" is an idea pushed by vendors as a way to cover up bug, by insisting it's the discoverer who is responsible for vulns not the vendor.
Yes, yes, if we remove every consideration other than how a discoverer discloses a vuln, we could say they should wait until it's patched.
But that means ignoring concerns larger than disclosure itself.
But that means ignoring concerns larger than disclosure itself.
Netgate's irresponsible Wireguard code in FreeBSD is just one example of this. However the discover chose to disclose the problems is meaningless compared to Netgate's grossly irresponsible behavior.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
It's the vendor's responsibility, not the discoverer's.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
