Vulnerability disclosure policies [LWN.net]

Vulnerability disclosure policies

Posted Jul 8, 2010 11:31 UTC (Thu) by error27 (guest, #8346)
Parent article: Vulnerability disclosure policies

Say if you find a wallet in the street. You would expect the owner to give you 10% of the money inside as a finders-fee after you returned it. That's the law in a lot of places. It's not unreasonable to expect a finders-fee for security bugs as well.

The trick is agreeing on a fair price. In the end you're paying for the information and the secrecy. So probably it should be a per day fee until the bug is fixed and a lump sum at the end.

I probably wouldn't take any money for returning a wallet, but I paid it happily the last time when someone found mine.

to post comments

Vulnerability disclosure policies

Posted Jul 8, 2010 12:25 UTC (Thu) by mpr22 (subscriber, #60784) [Link] (5 responses)

Uh, no, I wouldn't expect a finder's fee for returning someone's wallet (even though I wouldn't be particularly offended, upset, or surprised to find they'd returned it sans cash - it's not like I can prove it was them who removed it!), and I think any law enshrining an entitlement/requirement for such should be amended or repealed to remove it.

I'd cheerfully buy the person who returned it a drink if all the cash was still there, though.

Vulnerability disclosure policies

Posted Jul 8, 2010 13:44 UTC (Thu) by NRArnot (subscriber, #3033) [Link] (4 responses)

Back in the days of film cameras, a keen photographer friend always kept a self-addressed and stamped envelope in his kit-bag, with a note asking anyone who had stolen the bag, to return the exposed films rather than throwing them away.

It worked.

Vulnerability disclosure policies - lost and found

Posted Jul 10, 2010 0:18 UTC (Sat) by giraffedata (guest, #1954) [Link] (3 responses)

It is the law in California, and I suspect most of the U.S., that if you find someone's lost property, you must make an effort to return it to its owner, and you are not entitled to any reward.

This expresses some people's view of civility, but it also may prevent the recovery of some property, since someone can't make a business out of finding and returning property. The same could be said about reporting bugs. If we consider it a person's obligation to disclose a bug for free once he finds it, how much incentive does he have to look for bugs?

Vulnerability disclosure policies - lost and found

Posted Jul 13, 2010 12:10 UTC (Tue) by mpr22 (subscriber, #60784) [Link] (1 responses)

He gets to feel smarter than the author of the buggy code.

Vulnerability disclosure policies - lost and found

Posted Jul 13, 2010 14:20 UTC (Tue) by giraffedata (guest, #1954) [Link]

If we consider it a person's obligation to disclose a bug for free once he finds it, how much incentive does he have to look for bugs?
He gets to feel smarter than the author of the buggy code.

That's a good incentive for hobby-level bug investigation, but not enough to give up one's day job or hire a staff or give someone a research grant. I don't know much about the project in question here, but I have the impression that many of these bug hunters put more than recreational level effort into it.

Vulnerability disclosure policies - lost and found

Posted Jul 15, 2010 3:43 UTC (Thu) by jjs (guest, #10315) [Link]

Better code? People search for bugs because they're USING the software. They find bugs and report them so THEY get better software. It's capitalism at its finest - people doing things because of their own interest.

Look at how Apache came into being for an example.

Vulnerability disclosure policies

Posted Jul 8, 2010 13:38 UTC (Thu) by NRArnot (subscriber, #3033) [Link]

The fair price is surely that the vendor of the software fixes the bug you report, promptly and without attempting to charge customers more for the benefit of the fix to what was a defective product in the first place?

With open software that's all but guaranteed. Even if the lead developers or maintainers won't fix it, the source is available so anyone else who cares can fork it and fix it. Anyway, in the absense of a direct profit motive, developers are motivated to maintain their reputation. The last thing they want is for that to be tarnished by not fixing security issues.

With proprietary? There are many cases of Microsoft and their like burying their heads in the sand for months or years until the bug is being exploited by vandals and criminals. There are also more than a few instances where the bug is fixed in the latest version only; no fix is made available to users of earlier versions who do not wish to pay to upgrade (or who may not wish to down, sorry up, -grade even if it were possible for free). In other words, the manufacturer is profiting by virtue of having sold a defective product in the first instance!

So my feeling is that zero disclosure is not unreasonable in the case of proprietary software. To put it crudely, screw them, because they are screwing you.

Vulnerability disclosure policies

Posted Jul 8, 2010 15:17 UTC (Thu) by foom (subscriber, #14868) [Link]

Must be a cultural thing. Here in the northeast USA, I've never heard of any such expectation.

I do have another expectation, though: that the wallet most likely won't be returned at all, or if it is, that 100% of the cash would have somehow gone missing by that time.

I guess if someone actually came to my door with my wallet, I might be sufficiently surprised and grateful that they made the effort of coming to me that I'd give them some of it. :)

Vulnerability disclosure policies

Posted Jul 17, 2010 8:39 UTC (Sat) by oak (guest, #2786) [Link]

> The trick is agreeing on a fair price. In the end you're paying for the information and the secrecy. So probably it should be a per day fee until the bug is fixed and a lump sum at the end.

How you could agree on the price without knowing the details about the issue e.g. is it even real?