Today is a two-steps-forward-one-step-back day for the Judiciary. They finally took our 2017 advice and established a policy for good guys to report security problems in their websites. This is really good — in principle, anyway. uscourts.gov/news/2021/10/1…
The general idea is that online systems are always under attack, so you want to encourage good hackers by saying things like:
1. These are the rules for trying to break our stuff
2. If you break those rules, here's what we'll do
3. If you don't break those rules, you're a friend
1. These are the rules for trying to break our stuff
2. If you break those rules, here's what we'll do
3. If you don't break those rules, you're a friend
Sometimes you even have a "bug bounty," where you say, "If you find a problem and tell us, we'll give you money." Most of the Internet giants do this. Some will pay LOTS of money for a vulnerability. Great. Our policy is here: free.law/vulnerability-…
Earlier this year, our policy exposed a vulnerability in the Python programming language that we reported and they fixed. These policies are great.
Unfortunately, the Judiciary has some problems with theirs.
Unfortunately, the Judiciary has some problems with theirs.
https://twitter.com/FreeLawProject/status/1387822967187406848
First, it has the tiniest scope you can imagine: Three websites, one of which doesn't exist. Notably absent? Any website that matters, like, say, PACER! 
Second, the policy seems to be administered by a third party (this is fine), but their website doesn't work (this is not fine). The policy is here: uscourts.responsibledisclosure.com. This website doesn't work: responsibledisclosure.com. 🤦
Third, questions about the policy go to support@responsibledisclosure.com. That's weird. Shouldn't they *not* go to a third party, and instead go to the Judiciary?
An org with a $7B/year budget should do better, but, OK, fine.
We also have some concerns about the language of the policy, but we'll leave those details to others.
The scope should grow over time, and, frankly, it doesn't matter that much who is running your VDP.
We also have some concerns about the language of the policy, but we'll leave those details to others.
The scope should grow over time, and, frankly, it doesn't matter that much who is running your VDP.
Two steps forward and one step back.
(We really want good things for the Judiciary!)
(We really want good things for the Judiciary!)
Let's see if this helps:
• • •
Missing some Tweet in this thread? You can try to
force a refresh
