full-disclosure - [Security] [vendor-sec] Re: Re: Vulnerability Disclosure Debate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: sarnold at wirex.com (Seth Arnold)
Subject: [Security] [vendor-sec] Re: Re: Vulnerability Disclosure Debate

On Sat, Aug 09, 2003 at 12:49:25PM +0300, Georgi Guninski wrote:
> Steven M. Christey wrote:
> >Whether open source organizations are a formal part of OIS or not, at
> >least some of them are advocating some form of "responsible"

For my own part, I -really- like rain.forest.puppy's RFPolicy; it is
very simple to understand for everyone involved, and it seems to work
better than just throwing bug information into the wind.

The only way anyone is going to take part in "responsible disclosure" is
if it is (a) easy (b) gives credit where credit is due. I think RFPolicy
goes a long way towards satisfying both points, but has the downside
that it is not "blessed" by a formal organization, thus many large
companies aren't likely to promote it.

I think people generally -want- to do The Right Thing, but reading more
than a page to figure out what the right thing -is- is likely to be a
disincentive towards doing the right thing.

-- 
"Dependence on computers is apparently making a significant fraction
of the population incurably stupid." -- Fritz Whittington
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030811/aacb726f/attachment.bin