PRE-ANNOUNCEMENT: BIND-Members Forum

[Jeffrey C. Albro]

On Wed, 31 Jan 2001, Cricket Liu wrote:
> > This is not an open source but a full/partial disclosure issue.
> 
> No, it's not.  No one is arguing that the vulnerabilities shouldn't
> be disclosed and disclosed fully.  The question is when.

I agree.  However, the "when" part needs to be laid out MUCH more
clearly.  If a vulnerability is found on the first of the month, and the
main bind tree is patched by the seventh of the month, how long do you
wait for vendors to patch their (assuming they have forked to some
extent) version?  To the 14th of the month?  How long will a viable fix of
the main source tree be held in secret?  

> Surely you can understand the need to patch critical pieces of
> infrastructure such as the root, gTLD and ccTLD name servers
> and to prepare patched binaries of BIND for various operating
> systems before the vulnerability becomes widely known.

Of course.  But how long do you give downstream developers?  Do you give
them N days, and when N+1 appears will the forum embarrass paying members
of your group?  If everyone signs an NDA, no-one can squeal.  Can a time
limit be put on the NDAs?

I believe this idea can help solve security problems faster, with less
advertisement of the exploit, but steps need to be taken to make sure that
is actually what happens. 

How is the conflict of interest solved?

-Jeff

> 
> cricket
> 
> 
>