[ news_security_news ]
Software Providers Annoy Bug Hunters
Doug Caverly
Staff Writer
2006-08-17
 Insider Reports RSS Feed
Bug hunters appear to be reconsidering the informal pact they've struck with software companies. Most of these unpaid researchers have been willing to quietly inform the manufacturers of any problems they discover. Now, some of them may be getting frustrated with the lack of response that can follow.
Terri Forslof, the security response manager at TippingPoint, spoke to CNET about the issue. "There is nothing more frustrating then trying to help a vendor secure its product in good faith and not getting decent communication back in return," she said.
A panelist at Black Hat and the director of VeriSign's iDefense, Michael Sutton, elaborated on that point. "An open line of communication is essential," he said. "It is the vendor's responsibility to proactively update the researcher on a regular basis on the progress that is being made in patching the issue."
Another person spoke to CNET about both sides' perspectives. "The tension has always been the same," said Paul Proctor, a Gartner analyst. "Researchers want the vendors to be more aggressive, and the vendors want the researchers to show more discretion. While they both have the same goal of a more secure Internet, their perspectives are different."
The chief security officer at Cisco Systems gave reasons for why the companies may choose to be silent. "We can create undue attention onto something that might hurt our customers," John Stewart said. "If we know, to the best of our knowledge, that there is a weakness in our product, we're attempting not to draw further attention to it."
I won't opine on which side is "right," but software companies aren't really in a position that allows them to negotiate. As Joris Evers, the author of the CNET article, wrote, "Without communication, vendors risk losing the progress made toward responsible disclosure."
Tag: Bug hunters
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
Doug is a staff writer for SecurityProNews, InternetFinancialNews, SearchNewz, and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
