bugtraq - RE: [Full-disclosure] Re: [WEB SECURITY] Cross Site Scripting in Google

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060706110606.24494.qmail@mail2.securityfocus.com>
Date: Thu, 6 Jul 2006 12:34:50 +0100
From: "Martin O'Neal" <martin.oneal@...saire.com>
To: <drfrancky@...urax.org>, "RSnake" <rsnake@...cking.com>
Cc: <bugtraq@...security.net>, <full-disclosure@...ts.grok.org.uk>,
	<bugtraq@...urityfocus.com>, <webappsec@...urityfocus.com>,
	<websecurity@...appsec.org>
Subject: RE: [Full-disclosure] Re: [WEB SECURITY] Cross Site Scripting in
    Google

> my opinion is that full disclosure is not for vendors .. 
> it's for users. full disclosure is for us to know how to 
> react on certain threads. 

Which is just fine if you are technically competent to understand the
threat, and there is also a valid mitigating strategy you can employ
immediately.  For the vast majority of situations though, this just
isn't the case.  The users are not technically competent enough to
understand the true threat posed by an entry on a news group (which are
generally hopelessly incomplete and/or factually inaccurate) and then
this is coupled with a vulnerable product that may be essential,
difficult to protect, and a stable official fix that may be weeks or
months away from delivery.

I personally also believe in full disclosure, but it has to be delivered
in a responsible fashion.  Dispatching vulnerabilities to a public list
without even attempting to contact the vendor is clearly not in the best
interest of the vendors nor the great majority of the user base.

Martin...

----------------------------------------------------------------------
CONFIDENTIALITY:  This e-mail and any files transmitted with it are
confidential and intended solely for the use of the recipient(s) only.
Any review, retransmission, dissemination or other use of, or taking
any action in reliance upon this information by persons or entities
other than the intended recipient(s) is prohibited.  If you have
received this e-mail in error please notify the sender immediately
and destroy the material whether stored on a computer or otherwise.
----------------------------------------------------------------------
DISCLAIMER:  Any views or opinions presented within this e-mail are
solely those of the author and do not necessarily represent those
of Corsaire Limited, unless otherwise specifically stated.
----------------------------------------------------------------------
Corsaire Limited, 3 Tannery House, Tannery Lane, Send, Surrey, GU23 7EF
Telephone: +44(0)1483-226000  Email:info@...saire.com

-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using 
manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------