Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I believe I have found some security vulnerabilities in a popular open-source desktop application, and have contacted one of the application's project organisers via their website. I got in touch mid-March, and got a response three weeks later, saying that it would be fixed. I sent a polite chase a couple of weeks later for a progress report, and after another two weeks, I've heard nothing.

I'm in no personal rush to have this fixed, and since it has probably been around for years, a couple of months here and there is probably not worth worrying about. But from a responsible reporting perspective, is there a website/organisation it can be elevated to? It is at least a mid-level risk, in my view.

(Aside: since the vulnerabilities are of a technical nature, I wondered whether this would be best on Programmers. However, since it is not a programming question per se, on balance I thought it would be more appropriate here).

Addendum, for interest. Following several months of sporadic discussion with the core devs, the bug is still not fixed, so I've released a note about the vulnerability into the public domain.

share|improve this question
    
I'm accepting @Flimzy's answer for now, but am open to other answers - if you have other ideas, roll 'em in! –  halfer May 1 '12 at 21:05
    
I wonder if my Q closers would be willing to point me in the direction of a site where I might ask this question? The purpose is clearly not for my personal benefit, and as per my conversation below, getting a confidential security report acted upon is proving difficult and frustrating. –  halfer May 21 '12 at 17:24
add comment

closed as off topic by Mokubai, slhck, EBGreen, Nifle, Sathya May 5 '12 at 12:07

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 2 down vote accepted

Is the Common Vulnerabilities and Exposures (CVE) site what you have in mind?

share|improve this answer
    
I'd initially have thought so, but I've just spent a fair bit of time on their site, and there is no simple mechanism for reporting (as far as I can see, anyway!). I think this is because one needs to be a CNA (CVE Numbering Authority) in order to report a vulnerability, so perhaps I need to get in touch with one of the Linux vendors on the CNA list? –  halfer May 1 '12 at 20:54
    
@halfer: Mmm... maybe. Can you report the vulnerability to your Linux distro? –  Flimzy May 1 '12 at 20:56
    
That's not a bad next step. But the application runs on all platforms (I run it on OS X) - and if I were a distro I'd go straight to the project in question. Still, they may well be able to lend a security researcher or otherwise speed up the process. Anyway, thanks for the answer - gives me something to try! –  halfer May 1 '12 at 21:04
    
Right, I'm not suggesting that it's a distro-specific tool, but the distro managers will be able to escalate the problem further (possibly including to CVE) if appropriate. –  Flimzy May 1 '12 at 21:06
    
If the upstream author doesn't respond fast enough, and the risk is severe enough, the distro may release their own patched version, too (which then other distros, and maybe the upsream author) will eventually pick up as well. –  Flimzy May 1 '12 at 21:07
show 7 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.