full-disclosure - Re: Valid disclosure analogy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <174EBC9B-B868-11D6-AD8E-0003936733C2@clusterfsck.net>
From: ib at clusterfsck.net (Isaak Bloodlore)
Subject: Re: Valid disclosure analogy

On Sunday, Aug 25, 2002, at 12:05 US/Pacific, hellNbak wrote:

> What ever happened to get your money out of Bank A and inform all of 
> Bank
> A's other customers via a public forum (media) in order to protect the
> general public from being abused by Bank A and their lack of
> security/process/whatever.......???
>
> Sure, change banks, but I think there is a greater responsibility here 
> as
> well.

What Defender Defender (what a name) fails to mention is, that if a 
bank misrepresents the security of its money and an accountant 
(affiliated or not) stumbles across this misrepresentation he IS 
required to report it. In the case of software vulnerabilities, we 
encounter a huge number of situations in which the bank ("software 
vendor") knowingly misrepresents ("unbreakable") the security of assets 
stored within.

Defender Defender (still amused) tries to liken the freedom to talk 
about mishandling of information or money in the bank with an actual 
break in, theft and destruction. This is an easy way to argue, 
especially if the intention is to criminalize the other party. Under 
quite similar circumstances Godwin's Law would prevent him from doing 
so.

What Defender Defender fails to mention is the fact that disclosure 
does not happen "because vendors have been soooo diligent in the past" 
but because they have not.