On Mon, Oct 10, 2005 at 09:38:21PM +0200, Javier Fernández-Sanguino Peña wrote:
> Here's what I would say, based on past experience:
>
> Notes to upstream developers regarding security bugs
> -----------------------------------------------------
[...]
Great! I'll start using that when reporting issues to smaller projects.
When I talk to bigger projects, I think I'll just add something like this to
the top:
****************************************
* IMPORTANT *
* PLEASE DO NOT ACT ON OR PUBLISH THIS *
* UNTIL THE RELEASE DATE *
****************************************
> 3.- Review the bug and make sure it's relevant. If you don't understand
> the issue we will gladly describe it to you. We don't usually write
> exploit code for issues, however, our game is finding bugs, not
> exploiting them.
I often write some half-baked crash exploit to verify that an issue is a
real issue. Steve sometimes write real exploits.
// Ulf
|
