lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 16 Jun 2010 20:29:39 -0400 From: Stephen Mullins <steve.mullins.work@...il.com> To: Valdis.Kletnieks@...edu Cc: full-disclosure@...ts.grok.org.uk Subject: Re: Congratulations Andrew My response to the "Full disclosure is cyber terrorism" thread, which was unpublished to the list, was: "I think the ultimate goal is to dissuade people from getting into hacking at all. Black hat, white hat, it doesn't matter what you call yourself if what you're doing is illegal regardless of intent and you hear a continuous stream of people going to prison in the news. It's all fun and games on the internets until you decide to "hack" Sarah Palin's email and end up in prison with your life irrevocably destroyed." "It seems clear that the goal of most legislation regarding "cyber crime" is to prevent anyone from independently developing the capability to discover and disclose secrets through fear of severe penalties while simultaneously preventing citizens from having the ability to keep secrets of their own (bans on encryption technology in various countries). This does not bode well for a certain kind of personality type that doesn't like to take "no" for an answer and has the curiosity and intelligence to dig deeper than accepting "access denied" as the final answer." The proof is in the pudding. The current state of "cyber crime" legislation amounts to, "do something involving computers that a powerful interest doesn't like and you will go down -- hard." Better learn to start taking "no" for an answer. Steve Mullins On Wed, Jun 16, 2010 at 11:06 AM, <Valdis.Kletnieks@...edu> wrote: > On Wed, 16 Jun 2010 16:44:06 +0200, "Jan G.B." said: > >> Oh and by the way.. he's still lobbying against FD, as you can see here: >> "Full disclosure is cyber terrorism" => >> http://www.securityfocus.com/archive/105/511801/30/0/threaded > > Dude needs to learn to be consistent. Kinda hard to support "FD is cyber > terrorism" while also whining about overinflated claims of cyberwarfare. > > In any case, his basic thesis is flawed. The fact that "most people seem to > agree with me" doesn't in fact mean it's true, only that most CNet readers are > just as confused as he is. Full disclosure is *not* terrrorism, any more > than the weather service issuing a tornado alert is terrorism. It may mean > I have more work ahead, but that's true for a tornado alert as well. And most > importantly, I'm not terrorized - I'm fully informed and can take actions > accordingly. It's *partial* disclosure that's terrorism. > > Consider the following two scenarios: > > "There are bombs at the following 7 specific locations, set to go off at 4PM > local time. The trash bin behind 1123 Haymarket, in a box under the steps at > 904 Maple, (etc etc)" > > "The Department of Homeland Security has received information indicating > an increased threat against building that have a 7 in the street address, > cars with a Q or J in the plate number, and turtles". > > Which one scares more people? > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists