Group releases anti-disclosure plan
A group of 11 of the largest software companies and computer security firms released the first public draft of a proposed bug disclosure standard on Wednesday, and asked the security community for comments.
The 37-page document sets out a detailed timeline for security vulnerability reporting, and standardizes the interactions between security researchers who find bugs and the software companies who write them. The group hopes to see the final version of the plan gain widespread industry acceptance.
"The meat of it is all about the process -- how people come around to handling everything where they can talk to each other," says Scott Blake, a VP at security software firm BindView, an OIS member.
[ Read more ]
- Article: An informal analysis of vendor acknowledgement of vulnerabilities (8 April 2002)
- Article: Full Disclosure of Vulnerabilities - pros/cons and fake arguments (8 April 2002)
- Article: Issues: "Save a bug, safe a life?" (1 April 2002)