lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <200507281120.45425.grisu@guru.at> Date: Fri Jul 29 12:09:31 2005 From: grisu at guru.at (Christoph Gruber) Subject: Our Industry Is Seriously Ethics Impaired Am Donnerstag, 28. Juli 2005 01:34 schrieb Williams, James K: > Yes, there is value in sharing it first with the paying > customers, but there is also great value in eventually disclosing > it to the public. Public disclosure == advertising, for both > the vuln buyer and the vuln discoverer. I've found that > commercial entities who deal in 3rd party vulnerabilities usually > want to share with the public after a few weeks/months. > Commercial entities who sell vuln audit/scanner/pen-test software > usually don't want to share all of their exploit code or > vulnerability information though. They want to share just enough > to get people interested in their products/services. The only workaround for that problem ist to pay the 0day-finder on a daily/monthly basis, so he will get 5000[add as much zeros here, as you want] USD for every month, the vulnerability ist not fixed. That will gain enough pain to the industry. -- Grisu 2B OR (NOT (2B)) = FF
Powered by blists - more mailing lists