Flaw finders to software makers: It's payback time

TalkBack 22 of 34:

Next »

« Previous

• Thread View
• Flat View

Producing responses

If a I, as a bug hunter, find a flaw, how do I get the manufacturer to do something? If I dump my findings on the internet, I'm a bad boy. If I'm a good boy and contact the manufacturer, I'm told to wait until they have a patch. At this point how do I get the manufacturer to do anything? How long is it reasonable to wait?

I know a little about the politics of fixing bugs. There is always something more important to do than fix this bug. How many times and from how many vendors have we all heard "It's a known problem, don't do that."

Give the manufacturer 30 days then publish. If they can't get it fixed in that time, then they need to contact me and try to convince me to extend for another 30 days. Second time they call, convice me again.

But how many times do I delay? I know some problems are much easier to say than they are to fix. I know some problems are a matter of adding, removing, or replacing a single character. Most of the time is comes down to getting approval to spend the time and make the fix.

I wish there were simple answers to this question. Hell, I'd take a complex answer.

Posted by: dmhunter@...   Posted on: 08/17/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now