full-disclosure - public comment period for the Draft Security Vulnerability Reporting and Responding Process (OISAFETY)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: se_cur_ity at hotmail.com (morning_wood)
Subject: public comment period for the Draft Security Vulnerability Reporting and Responding Process (OISAFETY)

real condensed version of my ideas...

 Most real vulnerabilities and their discoveries occur the wild... obviously
some on machines not belonging to the creditor / discoverer. Often you
say... what do I do with this info? If I report it i may be arrested? If I
dont someone with evil intentions may and will.  Jurisdiction is so enormous
in scope to define any punishable offence. The world in general needs to
accecpt that internet parcipation is on a voluntary basis, and carries such
risks of a "open market". It is quite unfortunate that profits were to be
made and maintained as a business structure long before there were ANY
accecpted standards of ANYTHING. I think the best possible comparison to the
real world is that of vintage aircraft and autos. Both are generally allowed
to continue thier operation without modern safegaurds, despite the dangers
of operating them in and around thier more modern counterparts. Given log
data to a court or jury of  two breakin / attack / compromise scenarios,
both orriginating from the same physical locale, can be very different
depending on techniques used, but yet one is punishable by the evidence and
one is not, although both were exactly the same.. this does not do for a
real world jail sentence.
 Until these issues are either accecpted or resolved... you  cannot have
punishible internet laws. If  internet crime manefests itself into a
physical crime or a crime where a person or companys assests were physically
transfered and recieved and / or  are of an officaly established
international monetary systems and infrastructure, then it is handled
acordingly . Crimes of this nature are already provided for in all major
countries as it is, as they have always been punishible since nearly the
time they have existed. Untill I can physically implode your CRT in your
face or  pop open a cdtray with  hot coffee in front of it and it spills and
burns you, I cannot see how there can be any definable standard  for
punishible electronic crime at all.

Donnie Werner
http://exploitlabs.com
se_cur_ity@...mail.com

----- Original Message -----
From: "Cesar" <cesarc56@...oo.com>
To: <full-disclosure@...ts.netsys.com>
Sent: Wednesday, June 04, 2003 1:20 PM
Subject: Re: [Full-Disclosure] public comment period for the Draft Security
Vulnerability Reporting and Responding Process (OISAFETY)

> Sorry, but it sucks.
>
> They forgot to add:
>
> Section 10.1
> If the finder doesn't follow this, he will be
> prosecuted and nobody in the security community will
> like him.
>
>
> Anyone with me?
>
> Cesar.
> --- Craig Ozancin <cozancin@...antec.com> wrote:
> > The Organization for Internet Safety is pleased to
> > announce the
> > beginning of the public comment period for the Draft
> > Security
> > Vulnerability Reporting and Responding Process.
> > This draft process is
> > the result of a lengthy collaboration between
> > leading security
> > researchers and  software vendors.  We have worked
> > hard to develop a
> > process that addresses the needs of both security
> > researchers and
> > software vendors, and provides a framework for
> > achieving our shared
> > objective of improving security for computer users,
> > the Internet, and
> > the critical infrastructures that depend on it.  We
> > welcome your
> > comments on the draft. Please read the draft and
> > find instructions on
> > submitting comments at http://www.oisafety.org/.
> >
> > The period for comments will close on 7 July, 2003.
> > The final process
> > document will be released at the Black Hat Briefings
> > (www.blackhat.com)
> > in Las Vegas from 28-30 July, 2003.
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter:
> http://lists.netsys.com/full-disclosure-charter.html
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
> http://calendar.yahoo.com
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>