lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <D7DDF83751235046BFAC82E1244EB4C808294DCE@usilms23.ca.com>
Date: Thu Jul 28 00:34:50 2005
From: James.Williams at ca.com (Williams, James K)
Subject: Our Industry Is Seriously Ethics Impaired


> List:       full-disclosure
> Subject:    RE: [Full-disclosure] Our Industry Is Seriously 
> Ethics Impaired
> From:       security curmudgeon <jericho () attrition ! org>
> Date:       2005-07-27 21:30:22
> Message-ID: Pine.LNX.4.63.0507271728130.13422 () forced ! 
> attrition ! org
> 
> On Wed, 27 Jul 2005, DAN MORRILL wrote:
> 
> : So is 3com willing to lean on Oracle or Microsoft, or Real, 
> : or anyone else to get the patch done in a reasonable time 
> : frame? So that the finder of the issue does not get bored 
> : or angry or worried that someone else will discover it and 
> : then claim full credit for it?
> 
> Why would they lean on any vendor? It is in their best 
> interest to let the vendor take as long as they want to fix an
> issue. 
> 
> Remember that they share this information with their paying 
> clients, so the longer it is "0-day", the longer it is 
> "exclusive" to 3com/clients, the more value it has. Pushing on
> a vendor to patch it faster doesn't do them near as much good
> in the end.
 
Yes, there is value in sharing it first with the paying 
customers, but there is also great value in eventually disclosing
it to the public.  Public disclosure == advertising, for both 
the vuln buyer and the vuln discoverer.  I've found that 
commercial entities who deal in 3rd party vulnerabilities usually
want to share with the public after a few weeks/months.  
Commercial entities who sell vuln audit/scanner/pen-test software
usually don't want to share all of their exploit code or 
vulnerability information though.  They want to share just enough
to get people interested in their products/services.

The only entities who may have no interest in disclosure are:

- the vendors who made and sell the vulnerable products
- people who practice non-disclosure on principle
- exploit hoarders (everybody needs a secret stash of 0-day)
- vendors who sell vuln audit/scanner/pen-test software

So, I guess we will have to wait and see exactly what 3Com
plans to do with the vuln info.

Regards,
kw
                                                          
Ken Williams ; Vulnerability Research 
Computer Associates ; 0xE2941985

Powered by blists - more mailing lists