bugtraq - Re: Vulnerabilities in some SCADA server softwares

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTim7GTcCr3CDEJypnSRmpp62TASJ8P7HvYZbcjnZ@mail.gmail.com>
Date: Tue, 22 Mar 2011 14:24:23 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: "J. Oquendo" <sil@...iltrated.net>
Cc: Luigi Auriemma <aluigi@...istici.org>, bugtraq@...urityfocus.com
Subject: Re: Vulnerabilities in some SCADA server softwares

> Analogy: Car owner has his car speed up ending up in almost near
> catastrophe. Car owner goes to media outlets condemning the
> manufacturer: "How could you be so reckless! Thousand of lives..."
> Reality: Car manufacturer was never made aware of the issue. How do you
> propose a manufacturer fix an issue?

Yes, the discussion definitely needed a car analogy...

The author decided to follow a particular route, probably not out of
malice, but because he believes that his responsibilities to inform
the public outweigh the responsibility to assist the vendor. You
wouldn't do the same, but you haven't discovered these bugs.

Unless your view is that you would rather not know about about
security problems at all, than see a disclosure mode you do not agree
with, I do not think it's fair to lash out against the reporter; and
it's not particularly fitting to do so on BUGTRAQ.

/mz