full-disclosure - McAfee + FUD ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 5 Aug 2008 15:29:47 +0200
From: "r0tten c0re" <david.jonass@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: McAfee + FUD ?

Hi all,

Seems like McAfee choose to counter FUD by more FUD which triggered this :
http://www.nruns.com/_downloads/PR-08-02_Reaction_to_McAfee_statement.pdf

I have been aware of the ongoing AV insecurity catastrophe but not
read about this mcafee<->nruns discussion. Anyways a good read.

"n.runs welcomes the AV-Industry SDL (Secure Development Lifecycle)
effort spearheaded by McAfee. While we greatly support the
introduction of an SDL, it will not entirely extinguish flaws with
security relevance. Although it has the potential of greatly reducing
their number and impact, it will not lead to invulnerable software. In
order to reach this goal, we consider it necessary to reduce the
amount of trusted code to an absolute minimum, reduce the attack
surface to an absolute minimum and place all untrusted code into a
strictly confined environment. This way no matter how badly the code
behaves, and no matter how many vulnerabilities it has, it cannot
violate the security requirements."

Regards,
David

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/