lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20020819072042.24216.qmail@email.com> From: sockz at email.com (sockz loves you) Subject: (no subject) ----- Original Message ----- From: "M L Lynch [ SotG ]" <fred@...-debaters.com> Date: Mon, 19 Aug 2002 15:38:12 +1000 To: <full-disclosure@...ts.netsys.com> Subject: Re: [Full-Disclosure] (no subject) > If you ever find a major security bug in a major piece of software, such as > M$ software, approaching the vendor directly does not work. Quite often they > will just add it to the end of the list of complaints, and might get around > to it in some future patch... if they feel like it... and if they think the > security bug you found posses great risk, they still won't fix it till they > feel like doing it.. instead, they now know who you are... and they take > subtle yet effective precautions to make sure you don't tell anyone about > it. I know. well then thats the company's problem isn't it. in a hypothetical situation like that you should be aiming your complaints not at the lack of a security industry but at the software developers idiotic business practices. > Atleast if proof of concept is out there, and the risk is publicly known, > they have some motivation to fix it, and the users of the product can take > precautions to get around the bug until it is fixed. not really. if the concept is out there but the vendor isn't going to do anything... then you're posing a greater security risk by having the vulnerability out there aren't you. forcing vendors to fix bugs by threatening to make those bugs public is a poor solution to shoddy workplace practices. > Anyway, my thoughts. interesting none the less > Cheers likewise -- __________________________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup
Powered by blists - more mailing lists