"Responsible disclosure" is a term that is used to describe a particular strategy that is employed when making a disclosure regarding the details of the functionality of hardware and software products. The general idea of this approach is to eventually make full disclosure of all relevant information regarding the products, while also choosing to withhold certain information for a limited period of time prior to making that full disclosure. By doing so, developers have the opportunity to identify and resolve issues with the products, thus minimizing the chances of hackers being alerted to those issues and taking advantage of them in the interim.
There are different opinions regarding the use of responsible disclosure. Proponents of the concept hold that in many cases the flaws involved with hardware and software products are relatively undetectable during the development stages and only come to light once the products are available on the open market. Once they are uncovered by selected users who make it a point to utilize the products in every possible way they can, those issues are reported back to the developers, who are then able to introduce fixes and upgrades that help to eliminate the problems. The full disclosure comes about when the fixes are released and made widely available to consumers. By using this low-key approach, there is less opportunity for unscrupulous elements to take advantage of the issues in the interim, since the chances of hearing about the issues is reduced significantly.
An alternative opinion of responsible disclosure is that the strategy is misleading and not in the best interests of user. This school of thought holds that full disclosure should occur as soon as an issue is identified, even if the developer has not yet formulated a fix for that issue. Proponents of immediate disclosure note that by doing so, consumers already using the products have the chance to make the decision about whether to discontinue use until a solution is developed, switch to a different product, or at least take steps of their own to protect their systems from malicious attacks.
There is no set time limit when it comes to responsible disclosure. In some cases, developers are able to create a solution that is released days or weeks after the issue is first discovered. At other times, it may take months before a fix is readily available. During this interim period, steps are usually taken to help minimize any damage that is caused, with full and responsible disclosure to follow once the final solution is released and can be easily accessed by all consumers using the hardware or software product.
