Summer of Clearinghouses

The article discusses the recent surge in ‘clearinghouses’ – collections of pre-disclosure vulnerabilities – and argues that these are largely a distraction from the real issue: the speed at which vulnerabilities are discovered and remediated. The author contends that the current trend is creating a fragmented landscape where numerous clearinghouses compete, leading to inefficiencies and a risk of vulnerabilities lingering under embargo. They argue that the true value lies not in the size of the pool, but in the speed of actuation – the ability to quickly transform a vulnerability into a patched and deployed solution. The article emphasizes that a growing pool indicates a failure, as it suggests the clearinghouse is struggling to keep pace with the influx of vulnerabilities. It advocates for a shift from ‘coordinated’ vulnerability disclosure (a manual process) to ‘orchestrated’ disclosure, where a single, automated system can deploy fixes simultaneously, minimizing the risk of vulnerabilities remaining unpatched for extended periods.