full-disclosure - [RHSA-2002:246-18] Updated Canna packages fix vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0212110349270.24310-100000@devserv.devel.redhat.com>
From: mjc at redhat.com (Mark Cox)
Subject: [RHSA-2002:246-18] Updated Canna packages fix
 vulnerabilities

> Can redhat explain what do they mean by "responsible disclosure"?

It's always been our policy to credit the folks that discover an issue
when they give us some advance notice to prepare updates and where we can
co-ordinate with them.  That practice has recently been labelled
"responsible disclosure".  I agree that we do need to define what we mean
by "responsible disclosure" as this phrase has been used for all sorts of
disclosure practices recently.  Personally, for example, I wouldn't class
the practice of researchers telling people who pay them for some product
or service before the issue is public "responsible disclosure" but many 
seem to.

Cheers, Mark
--
Mark J Cox / Security Response Team / Red Hat