What Security Researchers Find Hiding in Public Git Repos
Recap of Marta Rybczynska's Open Source Summit talk on data leaked in public Git repos, including a real Traefik CVE disclosure-lag case and what it means for vulnerability scanning.
Tag: #vulnerability-disclosure
MD5 Is Broken: A Memo to the Server Admin, and Should You Publish the Code That Broke It?
A fictional server still signs certificates with MD5, a hash broken since 2008. A memo to the admin, and the question it raises: should researchers be free to publish code that breaks an algorithm?
Making the Hard Call: The PLUS Framework Applied to Two Security Dilemmas
Two security dilemmas: a researcher whose vendor won't patch, and an engineer told to delete subpoenaed emails. Four questions (Policy, Legal, Universal, Self) show where the right call comes from.