[ insider_reports_insider ]
Microsoft Won't Sue Over Legitimate Flaw Discovery
David Utter
Staff Writer
2008-04-21
 Insider Reports RSS Feed
Security researchers do not want to end up being arrested or sued for pointing out problems on a website, and Microsoft would rather know the awful truth than prosecute.
 | | Microsoft Won't Sue Over Legitimate Flaw Discovery |  |
If Microsoft's web properties are being a little indiscreet, they would rather know about the problem. It's a nice way of getting security researchers to do a little of Microsoft's work for it.
The Register cited a Microsoft representative's views on the topic of ethical hackers finding and reporting flaws they discover on websites. Prosecutions have happened elsewhere when a well-meaning researcher drops a company a note about a problem, only to be rewarded with lawsuits or jail.
At Microsoft, they prefer to find out when there is a problem, the report noted:
"This is actually really important because online services - that's our stuff," Microsoft security strategist Katie Moussouris told several hundred researchers. "The philosophy here is if someone is being nice enough to point out your fly is down, they're really doing you a favor and you should thank them rather than calling the cops and saying you're a pervert." Though we haven't heard of anyone being arrested for pointing out the, um, barn door is open, it's nice to know Microsoft is watching out for undone zippers and encouraging others to do the same, from a security standpoint.
Attempting to prosecute people who discover these problems with an interest in bringing them to the attention of the site publisher never made much sense. If someone's running Metasploit 24/7 trying to crack a site and gets caught, that's a different issue.
Some of these prosecutions, we'll suggest, happened out of corporate embarrassment. Persons responsible for the technology in question shove the blame onto the "evil hacker" for discovering a flaw, in order to safeguard their jobs.
We hope, of course, that Microsoft won't turn any engineers into Soylent Green if some security pro points out a problem with a Microsoft web property. That would be counter-productive.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
