Dropbox updated its vulnerability disclosure policy Wednesday, not only looking to clarify its relationship with cybersecurity researchers, but also attempting to set a standard for the rest of the tech industry. The San Francisco file-hosting company said the move is a response to “decades of abuse, threats, and bullying” against researchers who find and describe bugs in commercial software. Lawsuits are common, and journalists as well as traditional researchers can be caught up in fights over vulnerability disclosures. The highest-profile ongoing lawsuit is Keeper Security’s defamation suit against Ars Technica journalist Dan Goodin about an article that described flaws in Keeper’s password manager. Dropbox’s new policy — which the company invited others in the industry to use as a template — was updated with the following elements: A clear statement that external security research is welcomed. A pledge to not initiate legal action for security research conducted pursuant to the policy, including good faith, […]
The post Dropbox revamps vulnerability disclosure policy, with hopes that other companies follow suit appeared first on Cyberscoop.
Continue reading Dropbox revamps vulnerability disclosure policy, with hopes that other companies follow suit→