Understanding whats behind secure@microsoft.com

I find it interesting to watch security researchers blast Microsoft for not communicating with them when the researcher(s) report what they believe is a possible vulnerability. I have enjoyed a great relationship with Microsoft when communicating, but to be honest, I don't normally fire email to secure@microsoft.com and actually just email team members.

Robert caught up with Stephen Toulouse on Channel 9 and got an Introduction to Microsoft's Security Response Center (the guys monitoring secure@microsoft.com) and got some good info on tape on the process that goes on when you fire them an email.

If you are new to doing security research and want to understand how Microsoft deals with it... comsider watching the video. It should be required viewing BEFORE you blast some venomous lack of disclosure rant on mailing lists like bugtraq. We just ignore you when you do that anyways.

On a side note, why doesn't someone at Microsoft give the rent-a-cops campus security team a different email address and forward security@microsoft.com to the Security Response Center. I bet there is a LOT of lost emails going to the wrong place because of this mix up.

security@microsoft.com != secure@microsoft.com

The first goes to the dudes driving the white broncos on campus. The second goes to the Security Research Center. Got it? Good.