full-disclosure - [Secure Network Operations, Inc.] Full Disclosure Conclusion?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1043884837.4467.268.camel@localhost.localdomain>
From: simon at snosoft.com (ATD)
Subject: [Secure Network Operations, Inc.] Full Disclosure Conclusion?

So in Conclusion:

	What I have understood by reading these mails is that for an individual
to post full disclosure advisories (including exploit code) is good. 
This helps the internet community to validate patches and their all out
security. So, for an individual, this is very good.

	For a security company to release full disclosure advisories however
might be an issue for the company. A company might want to consider
releasing the information to the vendors only.  And the vendor should
release a patch.

	Problem is, the pressure from making an issue known is often what gets
the issue fixed.  So with that said, there should be a different way for
companies to leverage vendors into producing patches without disclosing
the full exploit and without causing damage to the industry and to
prospective clients. That is, only if the company will be politically
damaged by releasing full exploit code. 

Is that accurate?  



On Wed, 2003-01-29 at 17:32, Richard M. Smith wrote:
> Today, it's a decision made by the security researcher and the company
> they work for who gets what exploit code.  Down the road, my expectation
> is that the question will be addressed in courts via civil lawsuits.  
> 
> Richard
> 
> -----Original Message-----
> From: Day Jay [mailto:d4yj4y@...oo.com] 
> Sent: Wednesday, January 29, 2003 5:16 PM
> To: Richard M. Smith
> Cc: full-disclosure@...ts.netsys.com
> Subject: RE: [Full-Disclosure] [Secure Network Operations, Inc.] Full
> Disclosure != Exploit Release
> 
> 
> And what makes you think that you and your friends who
> share your dozen exploits are the right hands? What
> because you have the skill to write them, you are the
> right hands?
> 
> Who decides who can have what?
> 
> That's what I thought.
> 
> > 
> > OTOH we know that public proof-of-concept examples
> > are going to get into
> > the wrong hands.
> > 
> > Richard
> > 
> 
> 
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
-- 
ATD <simon@...soft.com>
Secure Network Operations, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030129/5d1522f1/attachment.bin