A group of 11 of the largest software companies and computer security firms released the first public draft of a proposed bug disclosure standard on Wednesday, and asked the security community for comments. The 37-page document sets out a detailed . . .
A group of 11 of the largest software companies and computer security firms released the first public draft of a proposed bug disclosure standard on Wednesday, and asked the security community for comments. The 37-page document sets out a detailed timeline for security vulnerability reporting, and standardizes the interactions between security researchers who find bugs and the software companies who write them. The group hopes to see the final version of the plan gain widespread industry acceptance.

"The meat of it is all about the process -- how people come around to handling everything where they can talk to each other," says Scott Blake, a VP at security software firm BindView, an OIS member.

The OIS officially formed in September of last year, but has its roots in a private Microsoft-hosted security conference held in Silicon Valley almost a year earlier. Member companies are Microsoft, @stake, BindView, SCO, Foundstone, Guardent, Internet Security Systems, Network Associates, Oracle, SGI and Symantec. (Symantec publishes SecurityFocus.)

The link for this article located at SecurityFocus is no longer available.