Google suggests 60-day limit on responsible disclosure
By Nicole Kobie
Posted on 21 Jul 2010 at 10:22
Google has called for new "rules of engagement" on responsible disclosure, after one of its own researchers courted controversy by publically revealing a Microsoft flaw.
Google employee Tavis Ormandy last month released details of a vulnerability in Windows Support, only a few days after alerting Microsoft, saying he had no response from the software giant and was looking to spur them to action. His move drew criticism from across the web, while Microsoft patched the flaw last week.
The emotionally loaded name suggests that it is the most responsible way to conduct vulnerability research
Ormandy was one of seven members of the Google security team contributing to a blog post calling for a new look at responsible disclosure and deadlines on firms to sort out flaws.
Google said resonsible disclosure - alerting companies to flaws before taking them public - is not necessarily always more "responsible" than full disclosure, which is publishing the vulnerability without warning.
"The emotionally loaded name suggests that it is the most responsible way to conduct vulnerability research - but if we define being responsible as doing whatever it best takes to make end users safer, we will find a disconnect," the post noted.
"We’ve seen an increase in vendors invoking the principles of 'responsible' disclosure to delay fixing vulnerabilities indefinitely, sometimes for years; in that timeframe, these flaws are often rediscovered and used by rogue parties using the same tools and methodologies used by ethical researchers," it added.
60 days to disclosure
Calling for software vendors to act responsibly too, Google said most critical bugs could be fixed within 60 days. "In our opinion, this small tweak to the rules of engagement will result in greater overall safety for users of the internet," the post said.
Google said its own security researchers find flaws in software from "a variety of vendors", and will support them if they publish flaws after giving companies a fair deadline to deal with the issue. It also said some flaws will need more "aggressive" deadlines if hackers are already aware of them.
The web giant admitted it would need to live by such rules itself, and had previously missed disclosure deadlines. In such cases, it's been "happy for publication to proceed, and grateful for the heads-up."
Is your business a social business? For helpful info and tips visit our hub.
People on Google Security blog don't understand cyber terrorism
It seems a lot of people on the Google Security blog don't even know what cyber terrorism is.
It is the act of posting a disclosure to change company or government policy, by way of cyber attacks created by the disclosure.
By n3td3v on 23 Jul 2010
- Hello Cortana, it's nice to meet you
- Windows 8.1 Update: an abject surrender
- The insane economics of Sky Now TV
- No such thing as a free app... so pay up if you want quality
- Time to outlaw crapware-laden installers
- Windows Phone 8.1 video: hands-on
- Office for iPad: key information
- Why every PC buyer owes Richard Durkin a debt of gratitude
- HTC One M8 vs Samsung Galaxy S5: 2014's big-hitters compared
- Windows XP end of life: key information
- How to write your company's IT security policy
- The key to choosing a secure password
- Please stop reposting fake Facebook messages
- Is Facebook safe for business?
- Don't rely on Chrome's password vault
- Facebook Graph Search: don't panic
- Gmail drafts and Pastebin: could they evade the email snoops?
- Applying for a job at GCHQ? Here's your plain-text password
- Google two-step verification: a must for business email
- Yes, I write down my passwords