Carrot Disclosure
Carrot disclosure Fri 08 March 2024 — download Once you have found a vulnerability, you can either sit on it, or disclose it. There are usually two ways to disclose, with minor variations: Coordinated Disclosure, where one gives time to the vendor to issue a fix before disclosing Full Disclosure, where one discloses immediately without notifying anyone before. I would like to coin a 3rd one: Carrot Disclosure, dangling a metaphorical carrot in front of the vendor to incentivise change.
- ▪Carrot disclosure Fri 08 March 2024 — download Once you have found a vulnerability, you can either sit on it, or disclose it.
- ▪There are usually two ways to disclose, with minor variations: Coordinated Disclosure, where one gives time to the vendor to issue a fix before disclosing Full Disclosure, where one discloses immediately without notifying anyone before.
- ▪I would like to coin a 3rd one: Carrot Disclosure, dangling a metaphorical carrot in front of the vendor to incentivise change.
Opening excerpt (first ~120 words) tap to expand
Carrot disclosure Fri 08 March 2024 — download Once you have found a vulnerability, you can either sit on it, or disclose it. There are usually two ways to disclose, with minor variations: Coordinated Disclosure, where one gives time to the vendor to issue a fix before disclosing Full Disclosure, where one discloses immediately without notifying anyone before. I would like to coin a 3rd one: Carrot Disclosure, dangling a metaphorical carrot in front of the vendor to incentivise change. The main idea is to only publish the (redacted) output of the exploit for a critical vulnerability, to showcase that the software is exploitable.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Dustri.
Discussion
0 commentsMore from Dustri
