A fuzzy issue of responsible disclosure

Unfortunately, rate-limiting the discovery of bugs is not going to fly well. This will only make the fuzzer frustrated and the upstream community that does that is likely to experience the birth of an outside fuzzer community that will wontinue to disclose bugs as they find them but will not, in any case, warn the maintainers of the discovery. To understand why I think that, you have to understand that fuzzers have incentives to report the largest number of bugs (for numerous reasons : to prove their products works, because their research project got a federal grant and they have to show results...).

And that's probably something nobody wants :)

There is no good solution to the issue outlined in this article. Security researcher ok'ed the principle of responsible disclosure because they typically don't find 10 bugs per week -- it's not their role and it's not how they work. They also have to prove that a bug is exploitable, otherwise their research is of less use. But fuzzers? They just have to prove that the bug exists. The "exploit" is written by a program and the testing is done by a program. The whole idea of fuzzing is based upon automation in order to quickly find new bugs. Asking for them to go the road of responsible disclosure is a bit contrary to the philosophy of fuzzing.