lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Mar 2011 17:28:59 -0400 From: Jeffrey Walton <noloader@...il.com> To: "Thor (Hammer of God)" <thor@...merofgod.com> Cc: full-disclosure <full-disclosure@...ts.grok.org.uk> Subject: Re: Vulnerabilities in *McAfee.com On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God) <thor@...merofgod.com> wrote: > I have that very strip printed and on the wall in my office :) You make several points, but the response that immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding vulnerabilities, and entering data in a search box. I don't know if there is any basis for this legally, but I feel that if you put a box up and I can search for something, then I can put whatever I want in that box. You (the royal you) are basically soliciting people to put data in the box. However, you are not asking anyone to spider your site or run scans against it. > If a person or company places a host on the public internet and offers a service, I don't think its reasonable to claim some input is "fair" and other input is "unfair". Perhaps the person or company should not offer public services in the first place. It seems reasonable (to me) that users of the site expect that the site is relatively defect free and secure. A tech-savy user who tests the site through its public interface is simply exercising due diligence before using the services of the site. I personally feel that individuals and companies which want to criminalize 'due diligence' is cowardly at best. I don't want to use the services of such a site; nor do I want to have an account on such a system. Jeff _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists