A Reputation-Based Mechanism for Software Vulnerability Disclosure

Whether and how to disclose software vulnerability information has been debated intensely. An optimal disclosure policy should balance the tradeoff between its impact on software vendors' incentives and the potential risks imposed on customers. Previous research on software vulnerability primarily focused on the timing aspect of the disclosure policy. In this paper, we investigate another dimension -the reputation aspect -of the disclosure policy. We propose a disclosure mechanism integrated with a reputation system which reflects software security level. Reputation by itself can effectively provide an incentive for software vendors to fix vulnerabilities. Furthermore, the reputation operator can partially release vulnerability details to optimize social welfare.