I will watch the Livecast about Software Vulnerability Disclosure, and I strongly suspect I will comment on it in this twitter stream.
Some recommendations will apparently be the output of today, but they seem to not be final yet(?)
First panel is interestingly composited - an Airbus CISO and a Microsoft Cybersecurity Policy person. The representative for civil society is missing - due to flue. A representative for security researchers is also missing, but wasn't on the agenda in the first place (?).
I am not sure if I would call the composition of the 2-person panel (dialogue?) balanced - but I will wait and see and give the benefit of the doubt.
Is there an easy way to figure out where which think tank gets it's funding from? It is hard to understand the battle lines / political influences for CEPS, stiftung-nv.de, and the other think tanks in the debate here.
Currently Lorenzo Pupillo surveys the various approaches to vulnerability disclosure. Somewhat focused on "on-paper processes", not necessarily on what happens in practice.
Pupillo calls for protection & incentives for security researchers, citing among other things the US hack the pentagon programme.
Unfortunately, the speaker's accent is so heavy that it is difficult to understand the actual recommendations :-/.
Are the actual recommendations available in writing for outsiders? I did not manage to understand them fully as they were presented.
The Microsoft guy argues that no vulnerability information should ever be made public without a patch being available.
Microsoft's lobbyist really hates disclosure.
I will self-censor somewhat now, but I don't think I could disagree more with the MSFT guy, and I do not see anybody on the panel that is capable to provide a counterpoint.
I am a big fan of @MarietjeSchaake 's question to the MSFT person, asking what the responsibilities of the software vendors are.
Good question by @blackswanburst on why disclosure dates are public, but not the dates of initial report to the vendor normally.
