full-disclosure - Fwd: NDA & SOX?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: grisu at guru.at (Christoph Gruber)
Subject: Fwd: NDA & SOX?

Ahoi!

Listening to a presentation on Thursday I wondered about the follwing thing:

SOX (Sarbanes Oxley Act 2004) forces the disclosure of information which
 could be relevant to investors (very short form).
For example: If a manufactorer of cars gets to knowledge of a certain
 weakness in his cars, he has to call them back and inform the public
 IMMEDIATLY about that thing.

If a manufactorer of software gets to knowledge of a certain weakness
(vulnerability), does he have to inform the public immediatly?
Is it even worse, if the manufactorer forces everyone, who has knowledge
 about that thing, to sign NDAs?

What do you think about that?

Please excuse my bad english.

--
grisu