One of my tasks at IOActive Labs is to deal with vulnerabilities; report them, try to get them fixed, publish advisories, etc. This isn’t new to me. I started to report vulnerabilities something like 12 years ago and over that time I have reported hundreds of vulnerabilities – many of them found by me and by other people too.
- Vendor not responding
- Vendor responding aggressively
- Vendor responding but choosing not to fix the vulnerability
- Vendor releasing flawed patches or didn’t patch some vulnerabilities at all
- Vendor failing to meet deadlines agreed by themselves
- Independent researchers and security consulting companies report vulnerabilities on a voluntary basis.
- Independent researchers and security consulting companies have no obligation to report security vulnerabilities.
- Independent researchers and security consulting companies often invest a lot of time, effort and resources finding vulnerabilities and trying to get them fixed.
- Vendors and CERTs should be more appreciative of the people reporting vulnerabilities and, at the very least, be more responsive than they typically are today.
- Vendors and CERTs should adhere and comply with their own defined deadlines.