How to report a vulnerability: Responsible Disclosure for Developers

on YouTube ↗48m

" summary

Vulnerability reporting requires concrete steps: CVE volume climbs to about 80 per day, so private, coordinated reporting and short embargoes matter. The log4shell case — log4shell scored 10 — leaks a public bug, sees exploitation within days, and prompts an initial patch in roughly a week with several follow-up releases. Use dependency scanners (Dependabot, Sonatype, Snyk), SBOM-style manifests such as a s-bomb, code scanners and tests (SpotBugs/FindSecBugs, PMD), publish a security policy/security.txt and rotate keys.

AI-written summary · about

" chapters (41)

1. 0:00Introduction
2. 0:45All software is bugs
3. 1:26Overview
4. 1:59Legal implications
5. 2:36Who is Brian
6. 3:41Gradle
7. 4:30What is vulnerability
8. 5:10Example
9. 7:08Cve vs Vulnerability
10. 8:04The Scary Graph
11. 11:26Definitions
12. 14:00Tomcat
13. 14:33Its not all good
14. 15:50The ideal timeline
15. 17:00Responsible disclosure vs full disclosure
16. 18:33Reporting
17. 20:06Public bug trackers
18. 22:53How long should the release period be
19. 24:51Three may keep a secret
20. 25:08The time to disclose
21. 25:54Resources
22. 26:41Log for Shell
23. 30:47Dependencies
24. 32:52Libraries
25. 35:16transitive dependencies
26. 35:49Healthy dependencies
27. 36:25Running insecure apps
28. 37:35Code Cove attack
29. 38:44Sbomb
30. 40:14Write less code
31. 40:53Dont let friends build off
32. 41:24You care about your code
33. 42:23Oz My Hope OS
34. 42:55Code Scanning Tools
35. 43:43Vulnerability are a Fact of Life
36. 43:54GitHub Pointer
37. 44:23Security Policies
38. 45:02Security Text
39. 46:07Bug Bounty
40. 46:32Conclusion
41. 46:56Outro

" related talks

• 18mWhat You Need to Know and Do about Vulnerability DisclosureAnne Bertucio · OpenSSF Day 2022
• 44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source SoftwareJennifer Fernick, Christopher R Robinson, Anne Bertucio · FOSS Backstage 2022
• 29mMake It Fixable: Preparing for Security Vulnerability ReportsPatricia Aas · CppCon 2018
• 01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source SoftwareChristopher R Robinson, Anne Bertucio, Art Manion · Linux Security Summit North America 2022
• 11mVulnerability Supply ChainsArt Manion · SupplyChainSecurityCon North America 2021
• 39mCVE 101: The Unfolding Of A Zero Day AttackTheresa Mammarella · Jfokus 2023
• 27mThrough the Looking Glass: How Open Source Projects See Vulnerability DisclosureMarta Rybczynska · Black Hat Europe 2023
• 32mBuilding a secure future using DEVSECOPS practices and technologiesDarlene Wilson · Women Techmakers Montreal 2024