To disclose or not to disclose? The hacker question
This 2013 article in The Sydney Morning Herald examines how long software vendors should have to patch a vulnerability before researchers publicly disclose it. Casey Ellis, CEO of Bugcrowd, says researchers may resort to full disclosure after patch deadlines pass unmet, and he credits Google's seven-day policy with making patches a higher priority.
Source description, as published
How long should a vendor have until they tell the world that a vulnerability in their software is being used to hack victims?
Inventors / authors: Liam Tung