On CBS MoneyWatch: Report: Tiger to Pay Wife $60 Million
BNET Business Network:
BNET
TechRepublic
ZDNet
TalkBack 39 of 90:
Next »
« Previous
IMMEDIATE and full disclosure is the best long-term solution
I believe that the best solution is immediate and full disclosure of all security vulnerabilities. In the long run, public censure, and loss of good will will make companies who put out shoddy products think twice *before* releasing a program. (As opposed to the current "release first, get money, patch later" model.) Customers will care more about software quality because they are the ones who suffer the loss when hackers inflict their damage. They will naturally gravitate towards solutions and vendors that fix problems faster and more efficiently-- in short, vendors who care about the customers first, not the bottom line.

True, testing won't find every flaw but there is no ethical responsibility for security researchers to protect the software vendor or users when (1) any vulnerability may already be in the wild, used by hackers to inflict damage, and (2) vendors disclaim all responsibility in their onerous EULAs.

Short term damage caused by more educated hackers is greatly outweighed by long-term improvements in the software development process.

In short, immediate and full disclosure is the best, most ethical system because it forces ACCOUNTABILITY on the vendor, and increases the awareness of risk management on the users. Remember, the quality of the product is the vendor's responsibility, not that of security researchers.

Cheers!
Posted by: Root User   Posted on: 01/26/05 You are currently: a Guest | Members login | Terms of Use
Reply to Story Reply to Message

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

IMHO...  BitTwiddler | 01/26/05
Absolutely agree  johnnybluenote | 01/26/05
Ok, if a reasonable time is 1 week.  DonnieBoy | 01/26/05
Nope, it was already decided  Roger Ramjet | 01/26/05
30 days is too much. You don't need 30 days unless you have spagetti code.  DonnieBoy | 01/26/05
No, 7 days is not enough  TechType | 01/26/05
"a deal ... ...between the vendors and the hackers"  el1jones | 01/26/05
The problem with that approach...  Michael Kelly | 01/26/05
That's why I said...  BitTwiddler | 01/27/05
Agree completely  FilledOut | 01/26/05
Key thought  Mack DaNife | 01/26/05
A corollary to your key thought  Judas I. | 01/26/05
Yes,l way too many problems with keeping things secret.  DonnieBoy | 01/26/05
30 days - already decided  Roger Ramjet | 01/26/05
So...  Mack DaNife | 01/26/05
It's just identity theft dude..  Jeff Spicoli | 01/26/05
My point exactly!  Mack DaNife | 01/26/05
Businesses ALWAYS couch it in those terms  Jeff Spicoli | 01/26/05
Yeah, and...  rapson | 01/26/05
They ain't, and that's why ...  Judas I. | 01/26/05
OMG  Mack DaNife | 01/26/05
Whoever made that 30 day pact ...  Judas I. | 01/26/05
It's not a pact...  OldeTimeGeek | 01/26/05
I see you have never tested patches...  Confused by religion | 01/26/05
Yer wrong, Milly, ...  Judas I. | 01/26/05
So it takes you  ksj99 | 01/26/05
Boo, hoo, poor widdle Microsoft!  Judas I. | 01/27/05
I like that one  IT Scion | 01/28/05
30 Days  Roger Ramjet | 01/26/05
What?  Judas I. | 01/26/05
Whoa there partner  Roger Ramjet | 01/26/05
Not that I am going to "spit the bit" here, Roger, ...  Judas I. | 01/26/05
OTOH  Roger Ramjet | 01/27/05
OTotherOH:  Judas I. | 01/27/05
I understand...  Mack DaNife | 01/26/05
OLAs  Roger Ramjet | 01/27/05
30 days??? reasonable???  rchasse2002 | 01/26/05
Not reasonable  Roger Ramjet | 01/26/05
IMMEDIATE and full disclosure is the best long-term solution  Root User | 01/26/05
One sided  Roger Ramjet | 01/26/05
One Sided Heck...  rchasse2002 | 01/26/05
There is a difference  rapson | 01/26/05
Well  IT Scion | 01/26/05
LOL  Roger Ramjet | 01/27/05
Not one-sided at all  Root User | 01/26/05
Evilution  Roger Ramjet | 01/27/05
Re: Evilution  Root User | 01/27/05
White Hats  JimSatterfieldW | 01/28/05
So you're saying...  rapson | 01/27/05
Re: So you're saying  Root User | 01/27/05
Got it  rapson | 01/28/05
Wow  IT Scion | 01/27/05
Re: Wow  Root User | 01/27/05
k...  IT Scion | 01/28/05
whoa, nellie !  culebra | 01/27/05
p.s.  culebra | 01/27/05
Re: whoa, nellie!  Root User | 01/27/05
I agree  culebra | 01/27/05
"Accountable" is the right word here  Root User | 01/27/05
Truth be known - this is an open society.  BetaMale | 01/26/05
Not so brilliant  IT Scion | 01/26/05
Who is the most irresponsible???  rchasse2002 | 01/26/05
I would say...  rapson | 01/26/05
But  IT Scion | 01/26/05
259.9MB, 1126 files, 260 folders  sam8988378 | 01/26/05
Not quite  rapson | 01/26/05
They still owe it to their customers to be honest  Michael Kelly | 01/26/05
I won't dispute that  rapson | 01/26/05
True, no one forces a criminal act...  Michael Kelly | 01/26/05
OK  rapson | 01/26/05
BS  Omch'Ar | 01/26/05
Not sure  rapson | 01/26/05
To make that point  ksj99 | 01/26/05
RE : 259.9MB, 1126 files, 260 folders  Unemployed IT Guy | 01/28/05
The only thing irresponsible...  Omch'Ar | 01/26/05
Secrecy is never a good thing  Gregory.J.Bradley@... | 01/26/05
Point by point  IT Scion | 01/26/05
What do you want  Roger Ramjet | 01/27/05
I Agree with Aitel  robradina@... | 01/27/05
Almost not worth it but  IT Scion | 01/27/05
Puzzled...  robradina@... | 01/27/05
and what about the negative consequences?  culebra | 01/27/05
Well  IT Scion | 01/28/05
careful with that axe, Eugene  culebra | 01/27/05
Aitel flaw finder  aljulong@... | 01/27/05
time and trouble...  liberalenextrema@... | 01/27/05
Something the "rebels" avoid discussing...  David A. Pimentel | 01/28/05
Flaw finders go their own way  marcvridenour | 01/28/05
Can a question be a non-sequiter?  jpslocum@... | 01/31/05
If they Know about it.Customers Should know about it!  a8a09923@... | 02/18/05

What do you think?

SponsoredWhite Papers, Webcasts, and Downloads

advertisement
advertisement