full-disclosure - Vulnerability Disclosure Debate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <025901c35d1d$96c54010$231a90d8@NTAUTHORITY>
From: geoincidents at getinfo.org (Geoincidents)
Subject: Vulnerability Disclosure Debate

> Nice stance, but complete off target.  Currently, Microsoft releases
> the most detailed advisories, in a consistent format, with extensive
> information about possible workarounds etc.

Microsoft's initial notification for the dcom exploit suggested blocking
port 135 as a possible workaround even though they were completely aware it
was a dcom issue which was available via multiple ports. Only after details
were released to the security community was it discovered this information
was incorrect.

I've seen countless times where the security community got details of a flaw
and used that information to uncover further issues. It is unreasonable to
expect whoever a vendor assigns to investigate a flaw is going to do as
thorough a job as the entire security community will if given the details.

Geo.