full-disclosure - Exploit release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: measl at mfn.org (J.A. Terranson)
Subject: Exploit release

On Sun, 4 Apr 2004, Martin Bealby wrote:

> I was thinking about the process of exploit release recently, due to the
> case of the Frenchman publishing his finding of research into those
> steganography programs, when I came upon a strange thought.
>
> If I find an exploit, and publish it straight away, I could annoy a
> (possibly large) number of users, and the software developers. Although
> I don't see how I could sensibly be attacked legally.
>
> However, if I find an exploit, notify developers, wait a certain time
> period (also told to the developers), and the developers have not and
> will not fix it, what can I do? If I publish anyway, wouldn't I be open
> to possible blackmail charges?
>
> Which option would be best to follow?
>
> Personally, I think it's a difficult choice. Option one seems to cover
> your own back but could lead to a large number of exploited machines,
> while option two should (theoretically) lead to fewer exploited machines
> (due to software updates), but could turn nasty. If I was faced with
> this situation, I'm not sure what I would do.
>
> Cheers,
> Martin

2 on the Troll-O-Meter.  Thanks for playing though.

-- 
"One of the nice things about ignorance is that it is curable.
Unlike Neo-Conservatism.

Eric Michael Cordian