View source for RFPolicy

{{Short description|Method of contacting vendors}}
{{One source|date=July 2024}}
The '''RFPolicy''' outlines a method for contacting [[vendor (supply chain)|vendor]]s about [[software security vulnerability|security vulnerabilities]] found in their [[product (business)|products]].  It was initially written in 2000<ref name="bugtraq">{{cite web |last1=Puppy |first1=Rain Forest |title=RFPolicy for vulnerability disclosure |url=https://seclists.org/bugtraq/2000/Jun/182 |website=Bugtraq mailing list archives |publisher=seclists.org |access-date=6 February 2025 |ref=bugtraq}}</ref> by hacker and security consultant [[Rain Forest Puppy]].<ref>{{Cite web |url=http://pcworld.com/news/article/0,aid,63944,00.asp |title=Three Minutes with Rain Forest Puppy |last=Zetter |first=Kim |date=2001-09-29 |website=PCWorld |url-status=dead |archive-url=https://web.archive.org/web/20010930194040/http://pcworld.com/news/article/0,aid,63944,00.asp |archive-date=2001-09-30 |access-date=2020-01-28}}</ref> It was perhaps the second disclosure policy, following Simple Nomad's.<ref name="nmrc">{{cite web |last1=Nomad |first1=Simple |title=Announcement |url=https://www.nmrc.org/pub/advise/policy.txt |website=Nomad Mobile Research Centre |publisher=Nomad Mobile Research Centre |access-date=6 February 2025 |ref=nmrc}}</ref> 

The policy gives the vendor five working days to respond to the reporter of the [[computer bug|bug]]. If the vendor fails to contact the reporter within those five days, the issue is recommended to be [[Full disclosure (computer security)|disclosed]] to the general [[community]]. The reporter should help the vendor reproduce the bug and work out a fix. The reporter should delay notifying the general community about the bug if the vendor provides feasible reasons for requiring so.

If the vendor fails to respond or shuts down communication with the reporter of the problem within five working days, the reporter should disclose the issue to the general community. When issuing an alert or fix, the vendor should give the reporter proper credit for reporting the bug.

Context for the history of vulnerability disclosure is available in a history article.<ref name="duo">{{cite web |last1=T |first1=Thu |last2=Meer |first2=Haroon |title=History of Vulnerability Disclosure |url=https://duo.com/labs/research/history-of-vulnerability-disclosure |website=Due Security |publisher=Cisco |access-date=6 February 2025 |ref=duo}}</ref>

==References==
{{Reflist}}

==External links==
* [https://dl.packetstormsecurity.net/papers/general/rfpolicy-2.0.txt RFPolicy v2.0]

[[Category:Computer security]]
[[Category:Software bugs]]
{{comp-sci-stub}}