lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.63.0507271728130.13422@forced.attrition.org>
Date: Wed Jul 27 22:27:27 2005
From: jericho at attrition.org (security curmudgeon)
Subject: Our Industry Is Seriously Ethics Impaired


On Wed, 27 Jul 2005, DAN MORRILL wrote:

: So is 3com willing to lean on Oracle or Microsoft, or Real, or anyone 
: else to get the patch done in a reasonable time frame? So that the 
: finder of the issue does not get bored or angry or worried that someone 
: else will discover it and then claim full credit for it?

Why would they lean on any vendor? It is in their best interest to let the 
vendor take as long as they want to fix an issue. 

Remember that they share this information with their paying clients, so 
the longer it is "0-day", the longer it is "exclusive" to 3com/clients, 
the more value it has. Pushing on a vendor to patch it faster doesn't do 
them near as much good in the end.

Powered by blists - more mailing lists