full-disclosure - This crap needs to stop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Nov 28 23:52:57 2005
From: pauls at utdallas.edu (Paul Schmehl)
Subject: This crap needs to stop

--On Monday, November 28, 2005 18:33:13 -0500 Eliah Kagan 
<degeneracypressure@...il.com> wrote:
>
> Todd is right.
>
> It is important to differentiate between maliciousness and a really
> embarrassing error. Sony *wrote* a rootkit for the purpose of cracking
> into their customers' systems to force their customers to act in a way
> more profitable to Sony, and to spy on their customers. It was not a
> mistake.
>
Well, that's not what I said, but doesn't a company have a responsibility 
to virus-check any software they ship *before* they ship it?  It's not like 
this is something so new that a normal check wouldn't have found it.

And isn't the *effect* on the end user the same?  Yes, the motivation was 
perhaps different, but how does that matter to the customer whose computer 
is now trojaned?  Does "we didn't mean to do it" excuse them?

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/