Software Vulnerability Disclosure: The Chilling Effect How the
Web makes creating software vulnerabilities easier, disclosing
them more difficult and discovering them possibly illegal
January 01, 2007 — CSO — Last February at Purdue University, a
student taking "cs390s—Secure Computing" told his professor, Dr.
Pascal Meunier, that a Web application he used for his physics
class seemed to contain a serious vulnerability that made the
app highly insecure. Such a discovery didn't surprise Meunier.
"It's a secure computing class; naturally students want to
discover vulnerabilities." They probably want to impress their
prof, too, who's a fixture in the vulnerability discovery and
disclosure world. Dr. Meunier has created software that
interfaces with vulnerability databases. He created ReAssure, a
kind of vulnerability playground, a safe computing space to test
exploits and perform what Meunier calls "logically destructive
experiments." He sits on the board of editors for the Common
Vulnerabilities and Exposures (