Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I want to propose a situation and gain insight from the communities thoughts.

A customer, call them Customer X has a contract with a vendor, Vendor Y to provide an application and services. Customer X discovers a serious authentication vulnerability in Vendor Y's software. Vendor Y and Customer X has a discussion.

  • Vendor Y acknowledges/confirms flaw.
  • Vendor Y confirms they will put effort to fix.
  • Customer X requests Vendor Y to inform all customers impacted by this. Vendor agrees.

Fast forward 2 months, and the flaw has not been fixed. Patches were applied to mitigate but the flaw still exists. However, no customers were informed of issue.

At this point customer X contacts Vendor Y to determine the status and understand why customer's were not informed. The vendor nicely reminds the customer they are under an NDA and are still working on the issue.

A few questions/discussion pieces out of this.

  • By discussing a software flaw with a vendor, does this imply you have agreed to any type of NDA disclosure? Additionally, what rights as does Customer X have to inform other customers of this vulnerability if vendor does not appear willing to comply?
  • I (the op) am under the impression that when this situation occurs, you are supposed to notify vendor of issue, provide them with ample time to respond and if no response you are able to do what you wish with the information.
  • I am thinking back to the MIT/subway incident where they contacted transit authorities, transit authorities didn't respond in a timely fashion so the students disclosed the information publicly on their own.
  • Few things to note about this: I am not the customer in above situation, also lets assume for purposes of keeping discussion inline that customer X has no intentions of disclosing information, they are merely concerned and interested in making sure other customers are aware until it is fixed so they do not expierence a major security breach.

(More information can be supplied if needed to add context to question. )

share|improve this question

closed as too localized by Loki Astari, maple_shaft, Chris, Caleb, ChrisF Nov 17 '11 at 17:11

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

5  
I think you should talk to a lawyer. –  Loki Astari Nov 9 '11 at 18:08
    
I think the vendor needs to get their collective crap together. Trying to hold a document like an NDA over your customers heads is not the kind of behavior that promotes repeat business. Also the customer while good intentioned really should mind their own business with respect to the vendor's other customers. The NDA probably doesn't apply, but the vendor could still sue the customer for loss of business and damages. Consult a lawyer. –  maple_shaft Nov 9 '11 at 18:33
    
@maple_shaft: One thing to note in this situation is an employee of Customer X happens to be an active community member for another project which makes him a stakeholder for exterior reasons outside of employment for customer X. –  Chris Nov 9 '11 at 20:02
    
To the votes to close: Please let me know why and perhaps we can reform the question to make it applicable. –  Chris Nov 9 '11 at 20:06
    
@Chris What a tangled web you weave... I wish I could know who this Vendor Y is so as to avoid them like the plague for my own benefit :) –  maple_shaft Nov 9 '11 at 20:17
show 3 more comments

1 Answer

Merely discussing something with Vendor Y generally does not automatically effect any kind of NDA or otherwise prohibit disclosure of the information, absent any such prior agreement. (If it did, most bug-tracking and full-disclosure lists would be useless. They almost always talk to the vendor first, for users' sake.)

However, if you were presented with an NDA (whether as a part or condition of your license agreement, or as a condition of Vendor Y entering into the discussion), and you agreed to it, then you are probably bound by it. In which case, you should definitely talk to a lawyer before you consider disclosing the vulnerability yourself.

share|improve this answer
    
Also, check any license agreements that apply to your company's usage of the vendor's product. They may restrict your right to disclose vulnerabilities. –  tdammers Nov 9 '11 at 21:31
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.