Gov't Vulnerability-Disclosure Program Draws Heat

AndreyF writes " Securityfocus.com reports: 'a long-anticipated program meant to encourage companies to provide the federal government with confidential information about vulnerabilities in critical systems took effect Friday, but critics worry that it may do more harm than good.' The article discusses both sides of the PCII question, but leaves me wondering why the pro argument rests on my trusting large corporate CEO's to 'do the right thing.'"

Comments

Which computer language?

[Anonymous Coward]

Is this Gov't Vulnerability-Disclosure program written in C or Java?

Re:Which computer language?

[Durin_Deathless]

Ada

I for one

[whackco]

welcome our ... oh, wait, I guess it would be old Bush overlords

Microsoft

[b0lt]

Does pretty much running all of the computers in the US count as being critical infrastructure? ;)

Re:Microsoft

[Rosco P. Coltrane]

If a critical infractructure runs Linux, can they just give PCII folks a tarball of the kernel source code to disclose their vulnerabilities?

Vulnerabilities

[psifishdot]

[A] long-anticipated program meant to encourage companies to provide the federal government with confidential information about vulnerabilities in critical systems...

You can find the vulnerabilities in my systems at http://www.debian.org/security/.

apt-get update
apt-get upgrade

Large corporate CEOs

[binkless]

Do you think that small corporate CEOs are more honest? What do you have against fat people anyway!?

Anyone Played Monopoly Lately

[Crypto Gnome]

A key provision of the law bars the government from using the vulnerability information in any enforcement action against the company, or from using it as the basis for proposing new legislation or regulations on industry.

Looks like Bill Gates just bought himself a get-out-of-jail-free card.