it's all about timing

[full-disclosure () lists netsys com (Eric N. Valor)]

I believe, depending on severity of the vulnerability, that one week should 
be sufficient for at least vendor response prior to publically leaking 
information about said vulnerability.  This does not mean releasing exploit 
code, only general information about the vuln so that educated readers can 
understand what's going on.

If no vendor responses occur, then release of information should occur.  If 
there is vendor response indicating an attempt to work the issue, then more 
time should of course be given (again, depending on severity of the issue).

Holes in this would include exactly *how* the vendor was contacted 
(midnight messages left in the general company voicemail don't count, etc.) 
and whether any follow-up attempts were made.  Also, a vanilla vendor 
response to the effect of "Thank you for the information.  We'll look into 
it.  Don't call us, we'll call you" is an effective NOOP.

Are we enough of an ad-hoc "authority" to attempt to determine a proper 
course of action for these instances?  Codifying this (even if it's just a 
"gentlemen's agreement") would most definitely be A Good Thing.
-- 
Eric N. Valor
ericv () cruzio com
PGP Key 2048/1024 227B04CB
Key Fingerprint = 766C CA15 0FFF E54B 2FEE  C7D7 0F87 3AFB 227B 04CB

: This Space Intentionally Left Blank :