full-disclosure - CERT, Full Disclosure, and Security By Obscurity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: yossarian at planet.nl (yossarian)
Subject: CERT, Full Disclosure, and Security By Obscurity

Possible, NZ is digital heaven compared to some other countries. Will you
make the alerting service free then? Because many posters do not like
commercial or government entities running away with their work. I am not
saying you will, but it just might happen - it is happening all over the
place.

I guess  the progress in our field made over the last few years, is
currently being reversed.

----- Original Message -----
From: "Arjen De Landgraaf" <arjen.de.landgraaf@...ogic.co.nz>
To: "'Steffen Dettmer'" <steffen@...t.de>;
<full-disclosure@...ts.netsys.com>
Sent: Saturday, February 01, 2003 11:02 PM
Subject: RE: [Full-Disclosure] CERT, Full Disclosure, and Security By
Obscurity

What about making it available through www.e-secure-db.us ?
right now it is a frozen copy, last update 30 October 2002.
However, that can be changed.

Arjen
New Zealand

-----Original Message-----
From: Steffen Dettmer [mailto:steffen@...t.de]
Sent: Sunday, 2 February 2003 10:15 a.m.
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] CERT, Full Disclosure, and Security By
Obscurity

* Len Rose wrote on Thu, Jan 30, 2003 at 09:22 -0500:
 [...]
> With the recent evidence that CERT informed it's paying members about the
> Sapphire SQL worm before the rest of the world should now indicate that
> they too are not a useful resource for timely and open security
information.
 [...]
> and the security information it hopes to provide
> may well become illegal (at least here in the US)
>
> To summarize my opinion, I feel that security information must simply be
> made available to as many people as possible as quickly as possible, and
> let corporations, systems staff, and security professionals handle the
> problems. "The public has a right to know.."

So we need a non-US OpenCERT?

When the US laws make it illegal to know about incidents, I think
finally incidents will need to be reported for and from non-US
only, hum.

Aren't the current practices here looking like steps backward?
Still confused...

oki,

Steffen

--
Dieses Schreiben wurde maschinell erstellt,
es tr?gt daher weder Unterschrift noch Siegel.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html