Microsoft will have nothing to do with any form of online vulnerabilities bazaar. This is true not only for security flaws affecting the company's latest operating system but all its products. The reason why Microsoft will not get involved into the commerce with security vulnerabilities is because it finds an equivalence between a zero-day marketplace and up front blackmail. In this context, Roger Halbheer, Chief Security Advisor Microsoft EMEA, criticized
harshly the WabiSabiLabi vulnerabilities auctioning website, revealing that the initiative is nothing more than another example of irresponsible disclosure.
"Every vendor has to have transparent and clear processes to handle vulnerabilities. These processes ensure that there will be a timely reaction on responsible disclosed as well as on irresponsible disclosed vulnerabilities causing so called zero-days. These zero-days pose a major risk to all the computer users on the Internet. One could agree now, that not the zero-day is the problem but the vulnerability itself," Halbheer stated.
|