Message-ID: <3D4931A5.3020704@guninski.com>
From: guninski at guninski.com (Georgi Guninski)
Subject: Re: it's all about timing

IMHO the threats against Snosoft are FUD, even more FUD than the Sklyarov FUD. I 
personally don't expect any court.

What scares me is that the "Responsible Disclosure" FUD continues.
On bugtraq people write that CERT and SecurtyFocus are "established parties" and 
everyone who does not give them their 0days is irresponsible (at least CERT is 
known to sell 0days). I personally won't give them my 0days early.

The "Responsible Disclosure" draft continues to get advertised, though it was 
not approved by IETF.

Why people think about giving away the right of free speech just because of some 
FUD?

Even in the unlikely case if this bad rfc pass, does it mean that that people 
are safer when they disclose problems - definitely don't think so.

So the facts are that some companies can't write secure code and it is more 
expensive to write secure code.

Just check "Help -> About" on Windows before using the word "responsibility".

The easiest solution is to shoot the messenger and to outlaw saying the emperor 
has no clothes. But this won't fix the problem in the real world. IMHO such 
regulations will only alienate a lot of people and will make things worse.

----
When I answered where I wanted to go today, they just hung up (Unknown Author)


Steven M. Christey wrote:
> The Responsible Disclosure Process draft specifically allows for
> researchers to release vulnerability information if the vendor is not
> sufficiently responsive.  Some people may disagree with the delay of
> 30 days between initial notification and release, but I don't think
> there are good stats on how long it really takes vendors to fully
> address vulnerability reports - open or closed source, freeware or
> commercial.  Let's take a recent example - how much coordination had
> to happen for the zlib vulnerability?  It seems reasonable to assume
> that it took more than a day.  And the controversial "grace period"
> has the interesting distinction of being used by both Microsoft and
> Theo de Raadt.
> 
> Researchers can help to shed light in this area by publishing
> disclosure histories along with their advisories.  (By the way, vendor
> advisories rarely include such information.)
> 
> While the response to the proposal focused almost exclusively on how
> it impacts researchers, it lays out a number of requirements for
> vendors, primarily that they (a) make it easy for people to file
> vulnerability reports, (b) be responsive to incoming vulnerability
> reports, and (c) address the issues within a reasonable amount of
> time.
> 
> IMHO, it makes a stronger impression when someone releases a security
> advisory with an extensive disclosure history that says how much they
> tried to resolve the issue with the vendor, before they released.
> 
> Those who are interested in the legal aspects of "responsible
> disclosure" are encouraged to read the article by Mark Rasch at
> http://online.securityfocus.com/columnists/66.  The article basically
> says that the adoption of community standards could protect
> researchers who disclose issues responsibly, while it could also help
> vendors who seek legal recourse against researchers who are not
> responsible (for some definition of "responsible").  The former could
> happen with a community standard.  The latter may already be happening
> without one.
> 
> This email is my personal opinion, not my employer's.
> 
> - Steve
> (co-author of the aforementioned Responsible Disclosure proposal,
> which is presently quiet but not dead, but will always be subject to
> public feedback)
> _______________________________________________
> Full-Disclosure - We believe in it.
> Full-Disclosure@...ts.netsys.com
> http://lists.netsys.com/mailman/listinfo/full-disclosure
> 
> 

Powered by blists - more mailing lists