full-disclosure - Re: Mr. Magorium's Wunderbar Emporium

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 16 Aug 2009 02:19:23 -0500
From: "Valdis' Mustache" <securitas.mustata@...il.com>
To: security curmudgeon <jericho@...rition.org>
Cc: full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu,
	spender@...ecurity.com, dailydave@...ts.immunitysec.com
Subject: Re: Mr. Magorium's Wunderbar Emporium

Briana,

While I applaud your efforts to grow as a professional beyond
pretending to be a member of ADM on Wikipedia and mirroring website
defacements, I find my hairs wax troublesomely askew at your dubitable
(nay, contemptible!) passive-aggressive assault on the related agnate
and likewise passive-aggressive assault by my owner on the redoubtable
Dr. Spengler's Magnum Opus.

While the esteemed doctor's heterodoxy may be a bit brash at times,
the fact remains that a gaping Christmas Islands-grade security chasm
remains ever present (whether via Mssrs. Ormandy and Tinnes' approach
or another) in every shipping variant of my favorite Finnish
engineered Minix work-alike, and this troubles me deeply.

True, Dr. Bradford's trollery and self-styled polemical "Dox Dropping"
may sometimes be a dry and bitter pill to swallow, but the
alternative, rearranging deck chairs on the Titanic and sloughing into
the tarpit of idle beauracracy, does little to improve matters.

People are getting owned, you halfwit, thanks to Fort Meade's woefully
ubiquitous filesystem ACL cum rootkit, and your response is yet more
sound and fury, signifying nothing.

I am, as ever, not amused.

Your humble servant,
Että Viikset ja Valdis

On 8/15/09, security curmudgeon <jericho@...rition.org> wrote:
>
>
> On Fri, 14 Aug 2009, Valdis.Kletnieks@...edu wrote:
>
> : Of course, getting a CVE for that issue would have forced disclosure of
> : the bug too, quite possibly before the vendors were ready to ship
>
> Huh? Apparently you don't know how CVE assignment works.
>
> If you request one from CVE, they can assign one without knowing any
> details of the vulnerability. CVE will embargo the details until the
> researcher and/or vendor are ready. I assume the Candidate Numbering
> Authorities would be able to do the same, but going to Red Hat, Debian or
> Ubuntu in this case may not be the best option.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/