full-disclosure - Fwd: NDA & SOX?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4231F933.70104@science.org>
From: jasonc at science.org (Jason Coombs)
Subject: Fwd: NDA & SOX?

Christoph Gruber wrote:
 > If a manufactorer of software gets to knowledge of a certain weakness
 > (vulnerability), does he have to inform the public immediatly?
 > Is it even worse, if the manufactorer forces everyone, who has
 > knowledge about that thing, to sign NDAs?

Let me take your question a little further... Suppose you are a 
"Director" of a public company, and you have knowledge of design flaws 
and vulnerabilities designed into a software product on purpose?

The flaws harm investors, they harm the public, they harm information 
security in general. They are unethical. You inform the company that the 
flaws exist, and nothing is done about them. Instead, you're slowly but 
forcefully pushed out of the company.

You've signed an NDA.

What do you do?

Regards,

Jason Coombs
jasonc@...ence.org