A group of 11 of the largest software companies and computer security firms released the first public draft of a proposed bug disclosure standard on Wednesday, and asked the security community for comments. The 37-page document sets out a detailed . . . . A group of 11 of the largest software companies and computer security firms released the first public draft of a proposed bug disclosure standard on Wednesday, and asked the security community for comments. The 37-page document sets out a detailed timeline for security vulnerability reporting, and standardizes the interactions between security researchers who find bugs and the software companies who write them. The group hopes to see the final version of the plan gain widespread industry acceptance. "The meat of it is all about the process -- how people come around to handling everything where they can talk to each other," says Scott Blake, a VP at security software firm BindView, an OIS member. The OIS officially formed in September of last year, but has its roots in a private Microsoft-hosted security conference held in Silicon Valley almost a year earlier. Member companies are Microsoft, @stake, BindView, SCO, Foundstone, Guardent, Internet Security Systems, Network Associates, Oracle, SGI and Symantec. (Symantec publishes SecurityFocus.) The link for this article located at SecurityFocus is no longer available. . A coalition of leading tech companies advocates for a fresh vulnerability reporting framework aimed at enhancing teamwork on security flaws.. Bug Disclosure Standard, Software Firms, Security Collaboration, Vulnerability Reporting. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.