Hacker News Reader

A problem arises when you notify them they have a security hazard: they either ignore it, or threaten a lawsuit if you don’t shut up.

View on HN

Some government -- anywhere in the world -- should offer a responsible disclosure service. You disclose to them a vulnerability, anonymously (e.g. via Tor) if you prefer, then they notify the target and impose a reasonable remediation deadline before publication.

And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.

In the Netherlands there is the NCSC (National Cyber Security Centre). They also scan the internet: It continuously monitors all (potentially) suspect sources on the internet. When it identifies a threat (such as a virus or an attack on a website), it alerts public authorities and organisations. and can act as a mediator: If you discover a security flaw in another government body (such as a municipality or province) or in an organisation with a vital function (such as an energy or telecoms company), please contact the body or organisation first. If you receive no response, please notify the National Cyber Security Centre, which will mediate between you and the body or organisation concerned. with anonimity garantuee: The government treats the notifications it receives confidentially. It will not share your personal details with third parties without your permission unless required to do so by law or a court order. while avoiding court cases for doing your civic duty: When you report the security flaw, check that you comply with the conditions described above. If you do so, the government will not attach any legal consequences to your notification.

Reply on news.ycombinator.com