The dilemma of disclosing vulnerabilities
A critical consideration arises when we discover a vulnerability – it presents a special responsibility.
There’s a separate issue if we work for an organization where we find vulnerabilities for them or third-party customers, where we’re subject to the rules of where we work. We often have to find the vulnerability, write a reliable exploit, and document it.
The decision to disclose vulnerabilities is a modern dilemma akin to a digital version of Shakespeare’s “To be, or not to be” speech.
What we did while writing the book
During the course of writing our book, we came across several vulnerabilities. We documented our findings in a brief technical report supplemented with screenshots and videos for clarity. Our next step was to notify the software authors or vendors about our discoveries, usually via email or social media. While waiting for a response, we either looked for the release of...
