This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
2013 has barely started and we've already seen it all. From scandals to the discovery of several major issues in various products. All of this brings an important debate back to the forefront.
How should a person who discovers a vulnerability inform the product's vendor? Should they even inform the vendor at all?
In fact, when a flaw is discovered in a security product, the person who found it generally has two choices. The first: inform the vendor, without making the vulnerability details public. The second: make all the information available, to everyone at once, on the Internet. Either way, there are pros and cons. It is, however, our view that the responsible disclosure of technical information about new security flaws is part of the duties of whoever discovers a security flaw.
There are often several obstacles for a person who has to report a vulnerability. The first is knowing who to report it to. That may seem trivial, but how do you find the right person when all you have at your disposal is a contact form on a multinational's website? Once the right person is found, everyone involved has to stay in touch for as long as it takes the company to fix the problem. At this stage, all parties need to show good faith. The person behind the discovery has to understand that the company's response can sometimes take a while. The company, for its part, has to take action and show good faith. In short, it has to take responsibility.
Once the problem is fixed, the company must warn its customers that there is a problem in their product and that an update is available. In that announcement, it's important that the company names the person who discovered the security flaw, unless that person doesn't want to be named.
What matters in the end is that the targeted company's customers aren't left with a major security problem on their hands without being able to protect themselves.
However, what happens if the targeted company doesn't answer the call from the person who discovered the flaws in its system?
Should a person in that situation make the information public or not? And if they do, are they protected by the law?
All the answers… In an upcoming post :P