From: arjen.de.landgraaf at cologic.co.nz (Arjen De Landgraaf)
Subject: CERT, Full Disclosure, and Security By Obsc
	urity

NZ is an ideal place, has some significant advantages; geographical
time difference, good comms infrastructure, stable economy and
great local talent etc.

We run a commercial service, www.e-secure-it.us  to keep us alive.
Although the commercial aspects have generated many rants and raves,
reality is that either we find a sponsor (often commercial security firm,
with 
all the (subjectivity) disadvantages), or run it, as many do, on a
shoestring, 
with (frequently changing) donated server space, bandwidth etc., lives 
devoted to trying to keep up with 24 x 7 x 365 monitoring, as massive 
undertaking, as we know out of three years of experience, real-time data 
entry and maintaining of a (well over 2 gig database etc).

Having to find that time and qualified people from somewhere. Believe me, 
as a commercial service you have exactly the same issues, especially 
with a small local market as New Zealand.

As an example of the ongoing cost to run a free service, only the free  
E-Secure-DB traffic already costs us NZ$3000 each month in bandwidth!!!!!
In my experience only a commercial base can give such a significant 
undertaking any long-term stability.

We are currently almost able to survive, as the design, outlay and  
operation of E-Secure-IT has all been funded out of our own pockets,
and, although we have no spare money to create sufficient awareness 
outside of New Zealand, we are growing; word of mouth is getting out 
now. FI. eEurope Action Plan;
 http://www.content-village.org/articles.asp?id=332
and http://www.content-village.org/articles.asp?id=333 )
 
As we are totally committed to contributing to a save Internet, we could 
open up part of E-Secure-IT itself (as we have now with Security News) 
for free access in a (moderated) posting format, links and files, as long as
this model would work for us all.

Arjen
New Zealand


-----Original Message-----
From: yossarian [mailto:yossarian@...net.nl]
Sent: Sunday, 2 February 2003 2:41 p.m.
To: Arjen De Landgraaf; 'Steffen Dettmer';
full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] CERT, Full Disclosure, and Security By
Obscurity


Possible, NZ is digital heaven compared to some other countries. Will you
make the alerting service free then? Because many posters do not like
commercial or government entities running away with their work. I am not
saying you will, but it just might happen - it is happening all over the
place.

I guess  the progress in our field made over the last few years, is
currently being reversed.



----- Original Message -----
From: "Arjen De Landgraaf" <arjen.de.landgraaf@...ogic.co.nz>
To: "'Steffen Dettmer'" <steffen@...t.de>;
<full-disclosure@...ts.netsys.com>
Sent: Saturday, February 01, 2003 11:02 PM
Subject: RE: [Full-Disclosure] CERT, Full Disclosure, and Security By
Obscurity


What about making it available through www.e-secure-db.us ?
right now it is a frozen copy, last update 30 October 2002.
However, that can be changed.

Arjen
New Zealand

-----Original Message-----
From: Steffen Dettmer [mailto:steffen@...t.de]
Sent: Sunday, 2 February 2003 10:15 a.m.
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] CERT, Full Disclosure, and Security By
Obscurity


* Len Rose wrote on Thu, Jan 30, 2003 at 09:22 -0500:
 [...]
> With the recent evidence that CERT informed it's paying members about the
> Sapphire SQL worm before the rest of the world should now indicate that
> they too are not a useful resource for timely and open security
information.
 [...]
> and the security information it hopes to provide
> may well become illegal (at least here in the US)
>
> To summarize my opinion, I feel that security information must simply be
> made available to as many people as possible as quickly as possible, and
> let corporations, systems staff, and security professionals handle the
> problems. "The public has a right to know.."

So we need a non-US OpenCERT?

When the US laws make it illegal to know about incidents, I think
finally incidents will need to be reported for and from non-US
only, hum.

Aren't the current practices here looking like steps backward?
Still confused...

oki,

Steffen

--
Dieses Schreiben wurde maschinell erstellt,
es tr?gt daher weder Unterschrift noch Siegel.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists