2021-043- Fred Jennings, Vuln Disclosure policy, VEP, and 0day disclosure - p2

<p><a href="https://twitter.com/Esquiring"><span style= "font-weight: 400;">https://twitter.com/Esquiring</span></a> <span style="font-weight: 400;">- Fred Jennings</span></p> <p> </p> <p><span style="font-weight: 400;">Vulnerabilities Equity program (VEP), vuln disclosure program (VDP), and what is the a way for disclosure of 0day? (‘proper’ is different and dependent)</span></p> <p> </p> <p><span style="font-weight: 400;">This show was inspired by this Tweet thread from @k8em0 and @_MG_</span><span style= "font-weight: 400;"><br /></span><a href= "https://twitter.com/k8em0/status/1459715464691535877"><span style= "font-weight: 400;">https://twitter.com/k8em0/status/1459715464691535877</span></a></p> <p><span style="font-weight: 400;"><br /></span> <a href= "https://twitter.com/_MG_/status/1459718518346174465"><span style= "font-weight: 400;">https://twitter.com/_MG_/status/1459718518346174465</span></a></p> <p> </p> <p><span style="font-weight: 400;">Legal Safe Harbor? Copy-left for security researchers…?</span></p> <p><br /> <br /></p> <p><span style="font-weight: 400;">What is a VEP? Not a new concept (2014)</span></p> <p><a href= "https://obamawhitehouse.archives.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities"> <span style= "font-weight: 400;">https://obamawhitehouse.archives.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities</span></a></p> <p><span style="font-weight: 400;">Context: Was written when Heartbleed came out.</span></p> <p><span style="font-weight: 400;">About transparency, but within reason</span></p> <p><span style="font-weight: 400;">From the blogpost:</span><span style= "font-weight: 400;"><br /></span><span style= "font-weight: 400;">“We have also established a disciplined, rigorous and high-level decision-making process for vulnerability disclosure. This interagency process helps ensure that all of the pros and cons are properly considered and weighed. While there are no hard and fast rules, here are a few things I want t