full-disclosure - Of course you guys support full-disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <NMRC.666.6.66.0208251055040.21915-100000@www.nmrc.org>
From: hellnbak at nmrc.org (hellNbak)
Subject: Of course you guys support full-disclosure

On Sun, 25 Aug 2002 phc_exterminator@...hmail.com wrote:

> It's no wonder you guys have all these striking analogies about
> why full-disclosure is inherently the work of God -- you are
> all making money off it.

Nope full disclosure is not the inherent work of god -- but it is the best
solution we have at this time.

> If you really cared so much about the security of the Internet,
> you'd do it as a volunteer or work in the non-profit academic
> arena. Otherwise, you have no choice but to defend to the death
> the ideology that gives you your weekly income.

Ahhh, so no one is allowed to have a job in something that they enjoy?
Maybe you like flipping burgers then running home and owning some boxes
but some of us have mortgages and families to support.  There is nothing
wrong with working in security or in IT.

A lot of us have jobs because there are a lot of idiots out there that
seem to think it is cool to deface websites, break into boxes, and
willfully cause damage.  I know your next argument will be that this is a
result of full-disclosure giving the s'kiddiots the tools they need and in
some cases you are probably right (usually defacements) but there are many
others cases that would prove you wrong.

 > The fact remains that the security industry is
actually
worse > than the corporate greed of companies like Microsoft, because
> while these vendors capitalize on need, perhaps without
> business ethics, you guys capitalize on fear, which you do
> everything possible to induce. It's basic business principles:

You are right -- SOME -- security companies do just that.  But as hard as
it might be for you to believe, not all companies do this.

> you create the need to harvest the profit. So essentially
> you guys need to instill fear in the public in order to make
> a quick buck. You also need to maintain a state of insecurity
> in order to profit. It's as simple as that. If the Internet
> was secure, you guys would go out of business. We don't want
> that, do we?

Thats bullshit, I personally would have no problem going back to general
IT work happy in the knowledge that my systems are "secure" -- but,
because of those who feel its necessary to constantly look for new ways to
break into boxes companies are going to constantly have the need to hire
security people.

Tell me, based on the PHC definition of a hacker -- one who breaks into
boxes, are you a hacker?

If so, then I have to thank you for the long term employement you have
given me.  You guys are not the solution, you are part of the problem.
Maybe even the root cause.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

"I don't intend to offend, I offend with my intent"

hellNbak@...c.org
http://www.nmrc.org/~hellnbak

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-