full-disclosure - Re: 0day Vulnerability in VLC (this is my first release of the vuln anywhere)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 Apr 2013 18:06:34 +0200
From: dawg <mlyodawg@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: 0day Vulnerability in VLC (this is my first
 release of the vuln anywhere)

Please remember that the title of the list is "full disclosure" not
"responsible disclosure". This is not a corporate list and nobody have
to act responsible if they don't want so. They are old enough to judge
what they do.

Some people are in the security field just for the fun part, that's not
their job. Contacting a vendor, collaborating with him, and waiting X
years for a appropriate patch is not that fun ;)

If the vendor is concerned about the security, he will see the mail sent
to this list and will act upon it.

>         > Nobody should release their disclosure/exploit (or give hint
>         about it) in
>         > the wild before letting the vendor fix it.

You should already be happy because they decided to release it and not
to keep it for them ;)

> I look forward to see who wins in this argument over personal opinion.
> 
> 
> On Tue, Apr 23, 2013 at 4:12 PM, Gregory Boddin <gregory@...hine.net
> <mailto:gregory@...hine.net>> wrote:
> 
>     You have to think about end-users as well ... Those are impacted
>     first, not the vendors.
> 
> 
> 
> 
> 
>     On 23 April 2013 16:51, Georgi Guninski <guninski@...inski.com
>     <mailto:guninski@...inski.com>> wrote:
> 
>         Completely disagree.
> 
>         IMHO nobody should bother negotiating with terrorist vendors.
> 
>         Q: What responsibility vendors have?
>         A: Zero. Check their disclaimers.
> 
> 
>         On Tue, Apr 23, 2013 at 04:14:53PM +0200, Gregory Boddin wrote:
>         > That's indeed not rocket science.
>         >
>         > Nobody should release their disclosure/exploit (or give hint
>         about it) in
>         > the wild before letting the vendor fix it.
>         >
>         > There's already enough blackhats out there selling/using those.
>         >
>         > I sure hope I am not the only person in the list who wishes
>         responsible
>         > > disclosure.
>         > >
>         > > ---
>         > > Henri Salo
>         > >
>         > > -----BEGIN PGP SIGNATURE-----
>         > > Version: GnuPG v1.4.10 (GNU/Linux)
>         > >
>         > > iEYEARECAAYFAlF2eWAACgkQXf6hBi6kbk8p+QCgkrzZnNpipCMC/kexFq8OR3Q2
>         > > NiIAnRMYicxFqmJhvjLIEZolEKjQcEEE
>         > > =q78V
>         > > -----END PGP SIGNATURE-----
>         > >
>         > > _______________________________________________
>         > > Full-Disclosure - We believe in it.
>         > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>         > > Hosted and sponsored by Secunia - http://secunia.com/
>         > >
> 
> 
> 
>     _______________________________________________
>     Full-Disclosure - We believe in it.
>     Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>     Hosted and sponsored by Secunia - http://secunia.com/
> 
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/