Opinion

Bruce Schneier on Disclosure: All or Nothing

Why full disclosure—or the threat of it—forces vendors to patch flaws.

By Bruce Schneier

This was a good idea—and these days it's normal procedure—but one that was only possible because full disclosure was the norm. And it only remains a good idea as long as full disclosure is the threat.

The moral here doesn't apply just to software; it's very general. Public scrutiny is how security improves, whether we're talking about software or airport security or government counterterrorism measures. Yes, there are trade-offs. Full disclosure means that the bad guys learn about the vulnerability at the same time as the rest of us—unless, of course, they knew about it beforehand—but most of the time the benefits far outweigh the disadvantages.

Secrecy prevents people from accurately assessing their own risk. Secrecy precludes public debate about security and inhibits security education that leads to improvements. Secrecy doesn't improve security, it stifles it.

I'd rather have as much information as I can to make an informed decision about security, whether it's a buying decision about a software product or an election decision about two political parties. I'd rather have the information I need to pressure vendors to improve security.

I don't want to live in a world where companies can sell me software they know is full of holes or where the government can implement security measures without accountability. I much prefer a world where I have all the information I need to assess and protect my own security.

Bruce Schneier is founder and CTO of Counterpane Internet Security.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Software Vulnerability Disclosure: The Chilling Effect
• The Vulnerability Disclosure Game: Are We More Secure?