Security Balance

I was visiting Dan Kaminsky’s blog today and I noticed that he is creating a community council to help on the disclosure of big vulnerabilities like the one he found on DNS and others that followed, including that famous one on TCP that Robert E. Lee and Jack Louis are planning to disclose after vendors have issued their patches. This is a very good outcome of all these happenings from the last months.

With a council like that everybody who finds a vulnerability and thinks that it is critical enough to start a coordinated effort to fix it and disclose the details will have a safe place to go. Not only it will be full of people with enough knowledge to verify their claims and to make sure it is not something old or not-that-big, but it will also be a trusted part that won’t “steal” the credits for the discovery. If they manage to make its existence and their purposes known to the security research community the only reason for someone to go into a “partial disclosure” alone will be “flash fame”.

Another step towards a more mature security research community. Nice!