full-disclosure - CVS REMOTE VULNERABILITY + STEFAN ESSER : UNSCRUPULOUS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6c7ba74374b705b2c6ee992a9dcedee1@remailer.cryptofortress.com>
From: nobody at cryptofortress.com (Anonymous)
Subject: CVS REMOTE VULNERABILITY + STEFAN ESSER : UNSCRUPULOUS

[snip boring blackhat whining]

> Refuse to acknowledge/support whitehat criminals who siphon off the
> intellectual property of others and attempt to capitalize on it.

Yes, yes, "whitehat criminals".

And the blackhats are as clean as a preachers' sheets.

Oh how the delusional criminal mind works!

The problem, as you see it, is that Stefan has announced something that
you considered to be yours, into a forum that didn't know "it" was "yours"
before now.

And the people on this list, and MandrakeSoft customers, and others that
will eventually patch up their CVS won't care whose it was - they'll just
be thankful someone told them.  Call them what you like, too - leechers,
scabs, whatever.  They don't care.  They'll support whoever tells them
about bugs in their systems that leave them open to people like you.  And
it kills you to think that they will.

The quandary for you is that if you want to prove your testicles are
bigger than Stefan's, or lcamtuf's, or anyone elses, you need to flop out
your apparently immense donugs onto the table before they do.  Problem
is that when you do, "the game is up".  And what would you be then?  A
"whitehat criminal"?

I'm left wondering how a bug in someone elses's code be your intellectual
property, as you are claiming.  The exploit code for it?  Sure.  But the
existence of the bug itself?  Who are you kidding?