lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: mxb285 at bham.ac.uk (Martin Bealby)
Subject: Exploit release

I was thinking about the process of exploit release recently, due to the
case of the Frenchman publishing his finding of research into those
steganography programs, when I came upon a strange thought.

If I find an exploit, and publish it straight away, I could annoy a
(possibly large) number of users, and the software developers. Although
I don't see how I could sensibly be attacked legally.

However, if I find an exploit, notify developers, wait a certain time
period (also told to the developers), and the developers have not and
will not fix it, what can I do? If I publish anyway, wouldn't I be open
to possible blackmail charges?

Which option would be best to follow?

Personally, I think it's a difficult choice. Option one seems to cover
your own back but could lead to a large number of exploited machines,
while option two should (theoretically) lead to fewer exploited machines
(due to software updates), but could turn nasty. If I was faced with
this situation, I'm not sure what I would do.

Cheers,
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040404/331d6d5d/attachment.bin

Powered by blists - more mailing lists