Article 3W1Z3 New open source effort: Legal code to make reporting security bugs safer

New open source effort: Legal code to make reporting security bugs safer

by
Sean Gallagher
from Ars Technica - All content on (#3W1Z3)
Screen-Shot-2018-08-01-at-11.22.21-PM-80

Enlarge / The Disclose.io project: open source contracts to keep white-hat hackers and developers out of legal trouble. (credit: Disclose.io)

Not a week goes by without another major business or Internet service announcing a data breach. And while many companies have begun to adopt bug bounty programs to encourage the reporting of vulnerabilities by outside security researchers, they've done so largely inconsistently. That's the reason for Disclose.io, a collaborative and open source effort to create an open source standard for bug bounty and vulnerability-disclosure programs that protects well-intentioned hackers.

The lack of consistency in companies' bug-disclosure programs-and the absence of "safe harbor" language that protects well-intended hackers from legal action in many of them-can discourage anyone who discovers a security bug from reporting it. And vague language in a disclosure program can not only discourage cooperation but can also lead to public-relations disasters and a damaged reputation with the security community, as happened with drone maker DJI last November.

Dropbox moved to fix its own vulnerability disclosure terms and was motivated to change its own legal policies following a certain lawsuit against a reporter over a vulnerability disclosure. Companies that manage bug bounties for large organizations, including HackerOne and Bugcrowd, have made their own efforts to get customers to standardize security terms.

Read 5 remaining paragraphs | Comments

index?i=1tj2tMCJjoU:A2pYHQLAYFA:V_sGLiPB index?i=1tj2tMCJjoU:A2pYHQLAYFA:F7zBnMyn index?d=qj6IDK7rITs index?d=yIl2AUoC8zA
External Content
Source RSS or Atom Feed
Feed Location http://feeds.arstechnica.com/arstechnica/index
Feed Title Ars Technica - All content
Feed Link https://arstechnica.com/
Reply 0 comments