Microsoft OK With Website Bug Hunters
Author: Dave Lewis
Do I hear a flood gate opening? This is a remarkable departure for the folks in Redmond.
From the Register:
In a first for a major company, Microsoft has publicly pledged not to sue or press charges against ethical hackers who responsibly find security flaws in its online services.
The promise, extended Saturday at the ToorCon security conference in Seattle, is a bold and significant move. While researchers are generally free to attack legally acquired software running on their own hardware, they can face severe penalties for probing websites that run on servers belonging to others. In some cases, organizations have pursued legal action against researchers who did nothing more than discover and responsibly report serious online vulnerabilities.
“This is actually really important because online services – that’s our stuff,” Microsoft security strategist Katie Moussouris told several hundred researchers. “The philosophy here is if someone is being nice enough to point out your fly is down, they’re really doing you a favor and you should thank them rather than calling the cops and saying you’re a pervert.”
Interesting article.
To the best of my knowledge, *two* companies have done this.
https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/securitycenter/general/ReportingSecurityIssues-outside
And, my explanation:
http://securityretentive.blogspot.com/2007/11/some-comments-on-paypals-security.html