full-disclosure - Re: Infosys TCS Wipro like companies don't know security basics?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 1 Dec 2011 18:21:50 +0530
From: "phyco.rootelement phyco.rootelement" <phyco.rootelement@...il.com>
To: Wonder Guy <blrwonderguy@...il.com>
Cc: Full-Disclosure@...ts.grok.org.uk
Subject: Re: Infosys TCS Wipro like companies don't know
 security basics?

Hi,

No offence, I think you have a wrong perception with these companies, They
are not into Zero day !!! They are just vendor specific support companies.
you cannot expect an vendor specific support company to find Zero day and
handle operations support both at same time. Sorry buddy that aint possible.

I am working with the one you have mentioned what ever Vulnerability we
identify are either for our vendors and we are not allowed by contractual
agreement to published identified vulnerabilities to public
domain. secondly If  I am identifying some Zero day why would I share it on
behalf of the company name .

Hope this clears your doubt about security basics.

thanks,

On Thu, Dec 1, 2011 at 7:24 AM, Wonder Guy <blrwonderguy@...il.com> wrote:

> Hi Security Experts,
>
> I have a question about the security track record of Indian IT vendors
> like Infosys, TCS, Wipro etc. An article about Indian IT vendors by an
> ex-employee of one of these companies is circulating in the different NITs
> (National Institute of Technology) of India today.
>
> My doubt is about this part of the article from
> http://susam.in/blog/re-infosys-tcs-or-wipro/#engineers <http://susam.in/blog/re-infosys-tcs-or-wipro/#engineers>
> :
>
> "Many claimed that I am wrong about the poor standard of training in
> Infosys, TCS, or Wipro. I must tell them that I have attended some of
> these training programmes. Among the many horror stories pertaining to
> training in these companies, I'll share only one with you to make my point.
> In the training assessments, the instructors set question papers
> containing problems with code that invokes undefined behaviour and ask you
> to predict its output. 'It Invokes undefined behaviour' is not provided as
> an option you can select as the correct answer. Such training and knowledge
> is not only inaccurate but also very dangerous if you care about robustness
> and security of the software you create."
>
> I am trying to verify this by using Secunia. I can find plenty of
> Microsoft and Google security vulnerabilities [
> http://secunia.com/advisories/search/?search=Microsoft+Google <http://secunia.com/advisories/search/?search=Microsoft+Google%C2%A0>]
> but none for Infosys TCS or Wipro [
> http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro <http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro%C2%A0>].
> What is the matter here? Indian software vendors are the best in the whole
> world in security matters or Secunia simply doesn't care about Indian
> software vendors?
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/