#RomHack2022 - James Forshaw - The Vendor / Researcher Relationship Needs Improvement

Researcher–Vendor Tension

James Forshaw of Google Project Zero delivers a RomHack keynote on improving relationships between security researchers and vendors. Having reported countless Microsoft flaws while also shipping Chrome and Windows sandbox code, he sees both sides' frustrations—vendors feeling attacked, researchers feeling stonewalled.

Vendor Responsibilities

Secure products require planning for external scrutiny from day one. Forshaw warns against intentionally hindering research, arguing any widely deployed software will attract probing and organizations should design for fixability rather than obscurity—sometimes favoring memory-safe languages to reduce bug classes.

Researcher Responsibilities

Researchers face time constraints and should choose targets wisely, accepting that some issues fall outside vendor support boundaries. He cites Microsoft's policy distinguishing user-to-kernel escalation (in scope) from administrator-to-kernel paths sometimes deemed out of scope—setting expectations before investing effort.

Disclosure in Practice

Forshaw critiques clunky vendor portals but praises responsive email channels when they work. Better mutual respect, he concludes, yields more secure products—the shared goal both sides claim despite recurring friction.