Hacker News Reader

Comment by DanAtC | Hacker News Reader

"Responsible" disclosure at best results in an embargo where "trusted" parties get to sit on it while the general public remains at risk. Worst case you get the cops knocking at your door.

(Full disclosure should be done anonymously to prevent the latter from happening anyway)

View on HN

But full disclosure places the general public at greater risk than responsible disclosure.

Let's say hypothetically someone found this hacked website, sent an e-mail to the site owners' security reporting contact, and after a year they hadn't taken any action.

Some would say a "responsible" disclosure which allows the danger to continue unabated for a year is a greater danger than a public disclosure, which would lead to the danger being fixed.

That is one hypothetical scenario, yes. Another hypothetical scenario is that as a result of responsible disclosure the site owners patch the hole and ensure customer data isn't publicly accessible before the vulnerability is public knowledge.

Seems reckless to me to not even _try_ responsible disclosure. You don't have to wait a year. But at least give a chance for the problem to be solved before you make it common knowledge.

Did I say hypothetically? Sorry, I meant to say exactly as happened [1]

[1] https://news.ycombinator.com/item?id=40169334

Right, so that’s a dataset of 1. Are you suggesting responsible disclosure never works because of your one time experience?

Of course not. I agree that responsible disclosure works perhaps 10% of the time.

It's the 90% of the time, when it doesn't work, that's the problem.

Only in the very short term. In mid-to-long term it increases the incentive to actually roll out a fix sooner then later.

Or you can possibly decide to shut down whatever service is vulnerable.

Reply on news.ycombinator.com