releasing information about security issues to the general public or a selected group.
20
votes
5answers
1k views
Open Source vs Closed Source Systems
My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, ...
24
votes
6answers
879 views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
9
votes
3answers
279 views
Reporting vulnerable sites
Take this scenario:
You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
11
votes
3answers
724 views
Which companies facilitate payment in return for vulnerability disclosure?
If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
11
votes
2answers
317 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
6
votes
3answers
256 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
17
votes
2answers
430 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
7
votes
4answers
346 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
3
votes
5answers
318 views
Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?
This is a multi-part question....
In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better?
...
6
votes
3answers
488 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
6
votes
2answers
248 views
Ethics and economy in security research
How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way?
Assume a market where the participants are governments, ...
5
votes
1answer
521 views
Tools to identify and report hacking attempts originating inside reputable organizations?
Re: Should I report hacking attempts? - Server Fault
Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
1
vote
1answer
361 views
Found huge bug, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a huge bug which gives me the possibility to get (through ...
10
votes
2answers
245 views
Progress in market approaches to software vulnerability disclosure?
In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
0
votes
0answers
78 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
