Previous
Mozilla: Vendors Still At Mercy Of Bug Hunters
News Those "responsible disclosure" efforts have had some effect, but security researchers maintain control over the process, Mozilla security chief Window Snyder said in a panel discussion at the ShmooCon hacker event in Washington.
[March 26, 2007, 9:19]
Security Firms Round On IE
News Two things come in play, one is you have to release a quality patch.the second thing that comes into play this is exactly a case where you did not have responsible disclosure," he said in reference to the way the vulnerability was made public...
[October 10, 2003, 16:10]
Bug-reporting Protocol Draws Flak
News The purpose of the document, says the IETF, is to describe best practices for a responsible disclosure process that involves vulnerability reporters, product vendors or maintainers, third parties, the security community and ultimately customers...
[February 27, 2002, 12:40]
Security Exploits: Who's To Blame?
News At issue is the push for "responsible disclosure" of software flaws by many industry players, including titans such as Microsoft, Oracle and Cisco. While many software makers promote responsible disclosure, it isn't universally backed by the...
[September 6, 2005, 16:40]
Did MS Bug Alarm Go Off Too Early?
News Full disclosure has to be coupled with responsible disclosure. The software titan has been on the warpath about responsible disclosure since last summer. Gary McGraw, chief technology officer for Cigital, said the company followed the unwritten...
[February 15, 2002, 9:05]
Fed-up Customers Want Faster Bug Alerts
News The findings undermine the push by several software makers, most notably Microsoft, and some security consultants, to define "responsible" disclosure as the release of information after a developer has had a chance to create a patch or after 30...
[July 4, 2002, 7:35]
MS Group To Oversee Hack Reports
News The latest announcement has already sparked controversy: Russ Cooper, a software security expert and editor of security mailing list "NTBugTraq," published his own guidelines for an independent security group, called the Responsible Disclosure Forum.
[November 9, 2001, 13:59]
Squashing Bugs With An Apple Fix A Day
News They say that responsible disclosure doesn't get good results — what is your opinion? We interviewed Fuller by email to find why he is devoting his time to the Month Of Apple Fixes, and to learn his views on responsible disclosure and the relative...
[January 10, 2007, 13:25]
Group To Set Bug-reporting Standards
News Earlier in February, security company Cigital touched off a responsible-disclosure debate when it informed The Wall Street Journal of the limitations of a security feature in Microsoft's latest tools for creating Windows and .Net applications.
[February 22, 2002, 10:56]
Do 'irresponsible' Security Researchers Help Or Hinder?
News That adds up to a lax attitude to security, some experts believe.eEye Digital Security abides by Microsoft's responsible disclosure guidelines, but posts the length of time since it reported a vulnerability to the software giant on a special page...
[January 26, 2005, 15:20]
Keep Your Sensitive Data Secure
News Inappropriate disclosure Unauthorised disclosure of such sensitive information could adversely impact your organisation with both civil and criminal liabilities. Is your organisation responsible for complying with one or more of the many privacy...
[July 6, 2006, 15:35]
Ten Government IT Projects In Danger
News The OGC refused to release further details as it judged the "public interest in disclosure was significantly outweighed by the public interest in non-disclosure". A PDF copy of the OGC disclosure is available here.
[March 1, 2005, 15:25]
Vulnerability Auctions Compromising Security
News I would speculate that if I am a vulnerability researcher and I have the option of, for example, a nice mention from Microsoft on an advisory under 'responsible disclosure' or pay off my mortgage, which one do I choose?
[July 19, 2006, 16:35]
TippingPoint To Offer Bug Bounty
News We want to reward and encourage independent security research, promote and ensure responsible disclosure of vulnerabilities and provide 3Com customers with the world's best security protection," David Endler, director of security research at...
[July 25, 2005, 15:05]
Rebuilding Investor Trust: Implementing Good Corporate Governance Practices
White Papers All solutions should be flexible and scalable, since regulatory demands for disclosure are likely to increase over time. To a great extent, IRO's will be the ones responsible for making sure that the company's policies and practices are...
[December 26, 2004, 23:00]
Microsoft Complains About 'irresponsible' Security Revelation
News We continue to encourage responsible disclosure of vulnerabilities. Microsoft has slammed the people responsible for publishing details of the vulnerability that has lead to the creation of the bofra virus.
[November 10, 2004, 11:28]
Microsoft Decries Information 'anarchy'
News Microsoft intends to force the issue and to call on security experts to draw a line between responsible disclosure and arming people with the tools and software needed to attack computers, said Culp. Microsoft, whose software has been at the centre...
[October 18, 2001, 9:02]
Malware Authors Exploit Microsoft's Monthly Cycles
News Ben English, security team leader at Microsoft Australia, told ZDNet UK sister site ZDNet Australia that Microsoft advocates a process of responsible disclosure and is "very keen" to discover any vulnerabilities before they are made public.
[November 10, 2004, 10:18]
Security Clearinghouse Under The Gun
News Most security researchers feel that responsible disclosure policy includes working with the affected software's creator to fix the vulnerability and then releasing the flaw information at the same time that the company releases a patch.
[January 30, 2003, 8:05]
Microsoft Admits WINS Flaw
News Microsoft continues to encourage responsible disclosure of software vulnerabilities. The disclosure of the WINS flaw revived an ongoing debate over how much time security companies should give software makers to patch a vulnerability before they...
[December 1, 2004, 7:35]
