bugtraq - Re: To anybody who's offended by my disclosure policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41A7F3CF.607@secnetops.com>
Date: Fri, 26 Nov 2004 22:26:07 -0500
From: kf_lists <kf_lists@...netops.com>
To: Berend-Jan Wever <skylined@...p.tudelft.nl>
Cc: Gadi Evron <ge@...uxbox.org>, full-disclosure@...ts.netsys.com,
   vuln-dev@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Re: To anybody who's offended by my disclosure
 policy

Berend-Jan Wever wrote:

>My disclosure policy:
>Most vendors treat "hackers" like free beta-testers that they can put the blame on when publicity goes bad. 
>
Not only that ... some of the vendors even try to make you pay for a 
support contract before you can report a security vulnerability. As a 
researcher I can certainly understand his frustration with trying to 
report a bug... sometimes it just gets to ya and you just don't give a 
flying whoot.

Vendors want the researchers to be the scape goat when a vulnerability 
is found... standard procedure is: 1. Brush under the rug. 2. Try to 
make the researcher look like a horrible person. 3. Downplay the 
vulnerability.

Stop trying to kill the messenger. Start holding your vendors 
accountable! Give guys like Skylined a break... hes doing you a favor.

GOBBLE, GOBBLE. Happy Turkey Day!
-KF

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html