full-disclosure - Re: Announcing new security mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: poptix at techmonkeys.org (Matthew S. Hallacy)
Subject: Re: Announcing new security mailing list

On Thu, Jul 11, 2002 at 06:00:25PM -0700, Blue Boar wrote:

> "You", meaning who?  Not I.. it went to my list:
> http://online.securityfocus.com/archive/82/261280
> 
> I have my own set of (often harsher) standards for what posts I allow on 
> vuln-dev... but that has nothing to do with Bugtraq.
> 
> I assume you mean Dave, whose reply is here:
> http://online.securityfocus.com/archive/82/261454

Sorry, it was Dave, I kind of see securityfocus as one large group..

> 
> I suppose you can accuse him of not stating his standards well enough up 
> front for what kinds of messages he considers fraud instructions.

How is it any different from someone writing an exploit and posting it to
the list? I didn't even include any scripts for it, I merely explained
the process (I did have people, such as 3Com (who still claim there is
no problem) say that it was not an issue with their product(s)).

> 
> I might not have approved the original message either.  For messages like 
> that, I'm often torn between my policy of not allowing posts that tell that 
> a particular site is vulnerable to a hole only they can fix, and allowing 
> the poster to implicate themself for the poking around they've done.  It 
> kinda depends if I feel like I've been made an accessory.  If so, I'll 
> usually approve it for the world to see.  Or, maybe forward to the FBI.  I 
> haven't had occasion to do the latter yet.

I didn't view it as illegal, I had been repeatedly informed by AT&T that
any speed limitations were due to hardware limitations, and that I should
feel free to download all the 'tweaks' available online, etc etc. Never
would they admit to having capped the service (I have the emails to/from
the AT&T tech support rep stating this)

> 
> The point being, that has nothing to do with the Bugtraq moderator holding 
> posts so he can warn a vendor to make a fix.

It's about censoring valid content based on a single persons feelings.

> 
> In your case, if I'm reading the headers correctly, there were only about 6 
> hours between when you sent the note to Bugtraq, and decided it wasn't 
> going to be posted?

Actually I had posted it that Friday, I waited until Monday ~2pm and 
re-sent it (thus the 'lets try this again' comment), only at that point
did I recieve a message back from the moderator that he was not going
to allow it through, with no explanation. 6 hours later I posted it to
vuln-dev

> 							BB

-- 
Matthew S. Hallacy                            FUBAR, LART, BOFH Certified
http://www.poptix.net                           GPG public key 0x01938203