The Vulnerability Disclosure Process: Still Broken

🗓️ 05 Sep 2018 17:03:08Reported by Tom SpringType

Vulnerability disclosure process is broken and fraught with issues. Researcher's challenges and tensions with vendors persist. Bug-bounty programs and rise of platforms have somewhat diffused tensions, but problems remain. Some examples of recent issues with Microsoft, Google, and Bitfi.

Source	Link
threatpost	www.threatpost.com/navigating-an-uncharted-future-bug-bounty-hunters-seek-safe-harbors/133202/
threatpost	www.threatpost.com/microsoft-windows-zero-day-found-in-task-scheduler/136977/
threatpost	www.threatpost.com/fortnite-skips-google-play-for-android-apps-irking-security-experts/134732/
hackerone	www.hackerone.com/blog/The-Hacker-Powered-Security-Report-Insights-from-Over-800-Programs
bugcrowd	www.bugcrowd.com/guest-post-standardizing-legal-safe-harbor-for-security-research/
disclose	www.disclose.io/
github	www.github.com/bugcrowd/disclosure-policy
resources	www.resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf
iso	www.iso.org/standard/45170.html
tools	www.tools.ietf.org/html/draft-christey-wysopal-vuln-disclosure-00

05 Sep 2018 17:03Current

7.2High risk

Vulners AI Score7.2