full-disclosure - ISS issues bug disclosure guidelines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: synrak at hotmail.com (SynRak)
Subject: ISS issues bug disclosure guidelines

I think a simple solution would be for everyone to give me their 0day code
and I will worry about who ends up with it :)

----- Original Message -----
From: "Georgi Guninski" <guninski@...inski.com>
To: "Richard M. Smith" <rms@...puterbytesman.com>
Cc: <full-disclosure@...ts.netsys.com>
Sent: Tuesday, December 03, 2002 5:16 AM
Subject: Re: [Full-Disclosure] ISS issues bug disclosure guidelines


> lol
> Personally don't care about ISS's guidelines. Of course they can do
whatever
> they wish with their 0days.
> *My* 0days are another topic. For them I care about applicable laws where
I live
> (and of course as this list shows, there are ways to post quite
anonymously).
> And this guideline:
> http://lists.netsys.com/pipermail/full-disclosure/2002-August/000822.html
> Is much more apealing to me.
>
> So after the responsibility rfc got busted, they are fighting at corporate
> ground, lol?
>
> I am thinking about making entities on my black list (microsoft,
securityfocus,
> mitre, cert) beg for 0days in any form.
>
> The idea is making a license agreement/non-disclosure agreement in the
> publication/code which makes them not eligible to read/use the
intellectual
> property at all. A lawyer said this approach is legal (of course it is
difficult
> to enforce). In addition encoding like ROT13 may be used to prevent them
from
> reverse engineering the IP (cough cough DMCA) :). There are several
precedents
> of high profile code which forbids including in sf's vuln db.
>
> Has anyone tried something like the above or has advice?
>
> Georgi Guninski
> http://www.guninski.com
>
>