lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: mxb285 at bham.ac.uk (Martin Bealby) Subject: Exploit release I was thinking about the process of exploit release recently, due to the case of the Frenchman publishing his finding of research into those steganography programs, when I came upon a strange thought. If I find an exploit, and publish it straight away, I could annoy a (possibly large) number of users, and the software developers. Although I don't see how I could sensibly be attacked legally. However, if I find an exploit, notify developers, wait a certain time period (also told to the developers), and the developers have not and will not fix it, what can I do? If I publish anyway, wouldn't I be open to possible blackmail charges? Which option would be best to follow? Personally, I think it's a difficult choice. Option one seems to cover your own back but could lead to a large number of exploited machines, while option two should (theoretically) lead to fewer exploited machines (due to software updates), but could turn nasty. If I was faced with this situation, I'm not sure what I would do. Cheers, Martin -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040404/331d6d5d/attachment.bin
Powered by blists - more mailing lists