Neil is conducting security research on a popular software application and discovers a buffer overflow. He considers reporting his finding to the vendor but realizes the EULA (End User License Agreement)
Forbids this kind of research.
What should Neil do?
A) Neil should sell his exploit on eBay. There is nothing wrong with making an honest dollar this way since the software itself should have been free in the first place.
B) The laws that protect the right to Full Disclosure are in higher standing than the EULA. It is a constitutional issue regarding speech and expression. Neil can reveal his findings without worry.
C) Report the finding to a neutral party such as a CERT coordination center
D) Anonymously report the finding to the bugtraq or "full disclosure" mailing lists

Question

Quizplus · Accepted Answer

Neutral third parties exist that will protect the anonymity of the person or organization that submits an incident or vulnerability. From there, the proper vendor can be notified. There is philosophical debate within the security community regarding whether or not to leak the information out after the vendor has been given fair time to respond but chosen not to. Most agree however that immediate full disclosure is a grey area at least.

Neil Is Conducting Security Research on a Popular Software Application