Zed's new project: Vulnerability Arbitration
With regards to use of the SSL-is-PGP trick discussed earlier, I think you may run into a problem in the real world of megacorps: the peons in charge of appsec may be several fiefdoms away from the peons who could actually access the private key for the SSL certificate.Suppose you report a SQL injection in X university's website.  I would have been responsible for getting that fixed at my old job.  I know what campus the guy with root on our web tier works at, but working on memory of our org chart, I can only narrow it down to a thousand people, literally.  Extraneous copies of that private key aren't floating around internally.  Indeed, I rather suspect that if there exists a process by which I can learn it, we just failed ISOSomething.  How am I supposed to figure out what your cypher text telling me what is wrong actually says?