A fuzzy issue of responsible disclosure

I posted a link to this in the thread on the quote that made 'brief items' in the last edition, but here it is again because I think it's good and well worth reading on the topic:

John Regehr wrote a good blog post a couple of years back about how to do fuzz-based and other automated bug-finding and reporting responsibly and effectively: https://blog.regehr.org/archives/2037 -- it touches on the "don't drown your upstream in bug reports" issue, and on incentive mismatches between bug-finders and project upstreams, as well as a lot of other points. Certainly if the people running fuzz testers are not a part of the conversation and not interested in interacting in a constructive way with upstream then sadness will result; but for those that are, I think John's blog post is a pretty good start on "how do I go about doing this without massively annoying people and failing to achieve the public-good aims of improving the software that are hopefully why I'm doing this fuzzing at all?".