full-disclosure - [len@...sys.com: pseudo-authoritative disclosure guidelines]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000501c32b90$b78493f0$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: [len@...sys.com: pseudo-authoritative disclosure guidelines]

Hi,

Regardless of what security researchers may do, I was wondering if the
vendors which make up OIS are willing to lead by example by immediately
practicing their proposed guidelines?   If they walk the talk, there
could be a bit more confidence that the OIS is not just in the business
of issuing press releases.

Richard M. Smith
http://www.ComputerBytesMan.com

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Len Rose
Sent: Thursday, June 05, 2003 1:19 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] [len@...sys.com: pseudo-authoritative
disclosure guidelines]

This is in reference to: http://news.com.com/2100-1002_3-1013423.html

----- Forwarded message from Len Rose <len@...sys.com> -----

Date: Thu, 5 Jun 2003 13:13:48 -0400
From: Len Rose <len@...sys.com>
To: rob.lemos@...t.com
Subject: pseudo-authoritative disclosure guidelines
Message-ID: <20030605171348.GC5519@...sys.com>

The OIS is meaningless and will have zero impact
on full disclosure practices. I'm surprised you're
lending any credence whatsoever to this pie in the
sky dream of controlling disclosure. As long as 
one independent researcher doesn't agree with these
guidelines it's all meaningless hype and blather.

Additionally, none of the members are very well-respected
by the security community and I predict that like
all the other so-called "full disclosure" guidelines
will be totally ignored.

I understand CNET's desire to keep headlines on their
web site but it's just another flash in the pan
press release.

Len

----- End forwarded message -----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html