Full-Disclosure Wins Again

twistedmoney99 writes "The full-disclosure debate is a polarizing one. However, no one can argue that disclosing a vulnerability publicly often results in a patch — and InformIT just proved it again. In March, Seth Fogie found numerous bugs in EZPhotoSales and reported it to the vendor, but nothing was done. In August the problem was posted to Bugtraq, which pointed to a descriptive article outlining numerous bugs in the software — and guess what happens? Several days later a patch appears. Coincidence? Probably not considering the vendor stated "..I'm not sure we could fix it all anyway without a rewrite." Looks like they could fix it, but just needed a little full-disclosure motivation."

Comments

This must be done

[PacketScan]

Full-disclosure has to be in place. Other wise these companies would never fix the problem. Well because it cuts into the bottom line and in effect costs income.

Nothing changes behavior...

[NerveGas]

... as well as having to bear the responsibility...or in this case, the twin-sister, liability.