Scribd
Upload
5 views1 page

Gray Hat Hacking 80

The RainForest Puppy Policy (RFP) version 2 outlines a full disclosure approach for reporting software vulnerabilities, emphasizing that reporters are not required to cooperate with vendors but are encouraged to do so. Upon reporting, vendors have five days to respond, and if they fail to do so, the reporter may disclose the vulnerability publicly. The policy encourages collaboration between the reporter and vendor to address the issue effectively.

Uploaded by

digapo7593
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
5 views1 page

Gray Hat Hacking 80

The RainForest Puppy Policy (RFP) version 2 outlines a full disclosure approach for reporting software vulnerabilities, emphasizing that reporters are not required to cooperate with vendors but are encouraged to do so. Upon reporting, vendors have five days to respond, and if they fail to do so, the reporter may disclose the vulnerability publicly. The policy encourages collaboration between the reporter and vendor to address the issue effectively.

Uploaded by

digapo7593
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Gray Hat Hacking, The Ethical Hacker’s Handbook, Third Edition

52
Reference
The CERT/CC Vulnerability Disclosure Policy
www.cert.org/kb/vul_disclosure.html

Full Disclosure Policy—the RainForest


Puppy Policy
A full disclosure policy known as RainForest Puppy Policy (RFP) version 2, takes a harder
line with software vendors than CERT/CC. This policy takes the stance that the reporter
of the vulnerability should make an effort to contact the vendor so they can work to-
gether to fix the problem, but the act of cooperating with the vendor is a step that the
reporter is not required to take. Under this model, strict policies are enforced upon the
vendor if it wants the situation to remain confidential. The details of the policy follow:

• The issue begins when the originator (the reporter of the problem) e-mails the
maintainer (the software vendor) with details about the problem. The moment
the e-mail is sent is considered the date of contact. The originator is responsible
for locating the maintainer’s appropriate contact information, which can
usually be obtained through the maintainer’s website. If this information is
not available, e-mails should be sent to one or all of the addresses shown next.
These common e-mail formats should be implemented by vendors:
security-alert@[maintainer]
secure@[maintainer]
security@[maintainer]
support@[maintainer]
info@[maintainer]
• The maintainer will be allowed five days from the date of contact to reply to
the originator. The date of contact is from the perspective of the originator of
the issue, meaning if the person reporting the problem sends an e-mail from
New York at 10:00 A.M. to a software vendor in Los Angeles, the time of contact
is 10:00 A.M. Eastern time. The maintainer must respond within five days,
which would be 7:00 A.M. Pacific time. An auto-response to the originator’s
e-mail is not considered sufficient contact. If the maintainer does not establish
contact within the allotted timeframe, the originator is free to disclose the
information. Once contact has been made, decisions on delaying disclosures
should be discussed between the two parties. The RFP policy warns the vendor
that contact should be made sooner rather than later. It reminds the software
maker that the finder of the problem is under no obligation to cooperate, but
is simply being asked to do so for the best interests of all parties.
• The originator should make every effort to assist the vendor in reproducing
the problem and adhering to reasonable requests. It is also expected that the

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy