Full disclosure of bugs needed, bloke reckons

SECURITY EXPERT Seth Fogie says that the process of public disclosure of software flaws is important because software outfits would ignore bugs if they could get away with it.

Writing in his bog, said he found flaws in EZPhotoSales, a web application you could buy to manage your online photogallery and sales.

After having a play with it he realised that the software was insecure and contacted the company to inform them of the many bugs he found.

The company admitted that EZPhotoSales had a number of flaws and was working on a new product to replace it. That was in March.

So, by August when the problem still wasn't fixed, the new product still was not out, Fogie went public.

He posted the problem to FD, Bugtraq, and InformIT and several days later a patch for the software appeared. He cites this as proof of how full disclosure of bugs was the only way to shift companies.