Timeline for Is a responsible disclosure for hardware-based vulnerabilities even possible?
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 25, 2023 at 14:44 | comment | added | Gh0stFish | @dudekowsky protecting the vendors reputation (and share price) is not one of the goals of responsible disclosure. The full and responsible disclosure movements largely came about because of companies who were more concerned about trying to protect their reputation than they were about securing their products. | |
| Apr 24, 2023 at 22:43 | comment | added | Ben Voigt | @dudekowsky: FTFY -- "possibly affects the vendors reputation in a negative-but-completely-deserved way" | |
| Apr 24, 2023 at 19:51 | vote | accept | dudekowsky | ||
| Apr 24, 2023 at 10:30 | comment | added | Steffen Ullrich | @dudekowsky: Always assume that other might find the same vulnerability (and maybe have already). So it is always necessary to inform the customers with enough details, so that they can mitigate the risk. Vendor reputation should be irrelevant here. | |
| Apr 24, 2023 at 8:20 | comment | added | dudekowsky | Thanks for your answer! This covers the customer side very well and I agree with everything you wrote. Let's assume the vulnerability can only be fixed by replacing the hardware (so its not a firmware issue). Would publicly disclosing such a vulnerability harm the vendor more comparted to a pure SW vulnerability? A SW vulnerability could be easily fixed in field, the hw vulnerability needs a replacement which means much higher costs and therefore possibly affects the vendors reputiation in a negative way. Should such a vulnerability therefore disclosed to the vendor only and not publicly? | |
| Apr 23, 2023 at 10:29 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 1 character in body
|
| Apr 23, 2023 at 8:52 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 37 characters in body
|
| Apr 23, 2023 at 8:46 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |