full-disclosure - RE: Symantec wants to criminalize security info sharing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4555-22330@sneakemail.com>
From: l8km7gr02 at sneakemail.com (l8km7gr02@...akemail.com)
Subject: RE: Symantec wants to criminalize security
 info sharing

Mr. Coombs,

I find your ideas intriguing and wish to subscribe to your newsletter.

Seriously though, you make some fairly serious accusations -- do you
have anything with which to back them up?  I'm not trying to be
adversarial, I just think it would make for some very interesting
reading.

Historically, have worms/malware visibly affected the US stock market?

Personally, I think that any move to restrict discourse (by Symantec
or others) without air-tight justification should be met with extreme
skepticism (and subsequent retaliation) by the public.  I very much look
forward to hearing how Symantec spins the announcement over the next few
days.

If it's true and Schwarz meant exactly how Wired represented him, I'm
still not convinced his motivations are (directly) dollar-based.  It's
all part of the same Branding movement, started in the early '90s.  It
wouldn't be unheard-of for Symantec to wish to trandscend its relatively
modest position in the AV world and make themselves out to be *the*
resource for security and recovery tools and information.

That doesn't mean it's right, of course -- it just wouldn't be
unexpected.

take care,

Cory

Jason Coombs:
> Look, it's time to be blunt -- Wired reporter Kim Zetter might have been
> confused, but whether or not the quote was accurate there is something
> important here that deserves full disclosure. If somebody else would step
> forward and offer this truth then it wouldn't have to be me, but here goes...
> 
> One of the reasons companies like Symantec lean toward restricting full
> disclosure is that secret knowledge of 0 day threats that are likely to turn
> into worms and other successful malware, or advance warning (even by a few
> minutes) in secret of the launch of a novel attack, is NOT considered "insider
> information" by the U.S. Securities and Exchange Commission.
> 
> Executives of Symantec have the ability, subject to normal restrictions on
> insider trading, to tip off friends and family or just their trusted stock
> broker over at <insert brokerage firm or investment bank here> and in so doing
> literally convert this knowledge into cold hard cash. And lots of it. Legally.
> Perpetually. It's a perk of being in the business.
> 
> We, members of the public, must be wary of unintentionally manufacturing
> billionaires who become so not because they have contributed real value to
> society and the wealth is their reward but who instead have learned how to
> hack the stock market.
> 
> All limits imposed on full disclosure of security vulnerability information
> serve the personal financial interests of the few at the expense of the many.