full-disclosure - Re: HP Full Disclosure Story

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20020824164221.GA29104@clusterfsck.net>
From: ib at clusterfsck.net (Isaak Bloodlore)
Subject: Re: HP Full Disclosure Story

Quoting Georgi Guninski (guninski@...inski.com):

> Just take a look at real world.
> When you buy a beer or a car and then find a bug in it, you may disclose 
> the bug as you wish. (As bonus, both beer and cars come with warranties, 
> unlike warez).

This analogy can be made even further. If a mother finds a flaw with
one of her toddlers toys which could potentially make it swallow parts
of it, notifies the vendor and he shrugs it off or fails to recall the
toy, he's in deep legal trouble. If the mother goes to the press,
knowing the vendor WILL shrug it off and potentially endanger
unsuspecting customers, she's a hero and the vendor will get public
and judicative heat. 

I can not imagine the public outcry if said vendor would threaten or
even sue the mother, for demonstrating the flaw. Simple fact is, that
it has not made it into the brains of public servants, that a software
flaw CAN potentially endanger millions of people - and the vendors do
a great job of keeping it that way.