full-disclosure - RE: Symantec wants to criminalize security info sharing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ILEPILDHBOLAHHEIMALBIEIHGOAA.jasonc@science.org>
From: jasonc at science.org (Jason Coombs)
Subject: RE: Symantec wants to criminalize security info sharing

Look, it's time to be blunt -- Wired reporter Kim Zetter might have been
confused, but whether or not the quote was accurate there is something
important here that deserves full disclosure. If somebody else would step
forward and offer this truth then it wouldn't have to be me, but here goes...

One of the reasons companies like Symantec lean toward restricting full
disclosure is that secret knowledge of 0 day threats that are likely to turn
into worms and other successful malware, or advance warning (even by a few
minutes) in secret of the launch of a novel attack, is NOT considered "insider
information" by the U.S. Securities and Exchange Commission.

Executives of Symantec have the ability, subject to normal restrictions on
insider trading, to tip off friends and family or just their trusted stock
broker over at <insert brokerage firm or investment bank here> and in so doing
literally convert this knowledge into cold hard cash. And lots of it. Legally.
Perpetually. It's a perk of being in the business.

We, members of the public, must be wary of unintentionally manufacturing
billionaires who become so not because they have contributed real value to
society and the wealth is their reward but who instead have learned how to
hack the stock market.

All limits imposed on full disclosure of security vulnerability information
serve the personal financial interests of the few at the expense of the many.

Sincerely,

Jason Coombs
jasonc@...ence.org

-----Original Message-----
From: Richard M. Smith [mailto:rms@...puterbytesman.com]
Sent: Thursday, September 11, 2003 3:47 AM
To: BUGTRAQ@...URITYFOCUS. COM
Subject: Symantec wants to criminalize security info sharing

Hi,

Here's an interesting quote from John Schwarz, the COO of Symantec, in a
Wired.com article from today:

   Just Say No to Viruses and Worms
   http://www.wired.com/news/infostructure/0,1377,60391,00.html

   "But perhaps the most controversial suggestion came
   from John Schwarz, president and COO of antivirus
   firm Symantec, who called for legislation to criminalize
   the sharing of information and tools online that can be
   used by malicious hackers and virus writers."

As we all know, when it comes to discussing information about computer
security vulnerabilities, it is difficult to separate security uses of
this information and hacking uses of the same information.

For example, if Symantec were to get this law passed, are they prepared
to see their employees who work on the Bugtraq email list go to jail?
;-)

Richard M. Smith
http://www.ComputerBytesMan.com