A fuzzy issue of responsible disclosure [LWN.net]

A fuzzy issue of responsible disclosure

Posted Aug 13, 2022 16:41 UTC (Sat) by developer122 (guest, #152928)
In reply to: A fuzzy issue of responsible disclosure by edeloget
Parent article: A fuzzy issue of responsible disclosure

It's not actually that complicated. Make a list. Append bugs to the end of that list. Retrieve bugs from the beginning of the list as needed. There is not an infinite number of fuzzer-detectable bugs in any given software.

If you want, you could also provide all the bugs in a non-public forum (as mentioned above). You only need to apply the above rate-limiting when making them public.

This is not a new concept. The entire reason behind the "90 day grace period" in "industry standard responsible disclosure" (which everyone should have encountered at least once by now even if it's not universally implemented) is a recognition that it takes time and effort for a vendor to resolve a bug. It's effectively the same rate-limiting, with a predefined time window set based on an assumed rate of bugs.

to post comments

A fuzzy issue of responsible disclosure

Posted Aug 17, 2022 9:22 UTC (Wed) by taladar (subscriber, #68407) [Link]

> There is not an infinite number of fuzzer-detectable bugs in any given software.

Maybe not, but there is a for all practical purposes infinite number of ways to reproduce even simple bugs. If the fuzzer reports are low effort enough and just report every reproduction instead of deduplicating the ones that cause issues in the same line with the same branches taken you might get lots and lots of effort-creating reports for every bug.

Lets say a bug is that an integer is used as a boolean and it crashes if that integer is neither 0 nor 1. Do you really want one bug report for 2,3,4,5,... each or do you want one that tells you it crashes for all values other than 0 or 1?