full-disclosure - RE: Disclosure policy in Re: RealPlayer vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041008221117.12217.qmail@paddy.troja.mff.cuni.cz>
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: RE: Disclosure policy in Re: RealPlayer
 vulnerabilities

On Fri, 8 Oct 2004, Martin Viktora wrote:

> I truly believe that vulnerability disclosure should follow these steps:

0. ("The primordial sin") The vulnerable product is released and all
information about the vulnerability is made available *by the vendor
itself* to anyone with enough competence, free resources, motivation,
and a copy of the product.

This is conditio sine qua non. The rest of the story is nothing but
deobfuscation of that information.

> Second, you say that vendors must work much harder at reducing patch
> development time and I cannot agree with you more, especially after
> what I stated above. 

Vendors must work much harder to avoid releasing vulnerable code in the 
first place. No vulnerabilities--no 0-says, no disclosures, no incidents, 
no need to hurry to install security patches.

Or, at least, they themselves should proactively find and fix
vulnerabilities in their own products. Isn't it absurd to wait until
someone else does their work (security QA) for them and even expect the
other party to follow their standards ("responsible disclosure")?

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."