full-disclosure - Help with reporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat Dec  3 09:57:15 2005
From: infosecbofh at gmail.com (InfoSecBOFH)
Subject: Help with reporting

Well said!

On 12/2/05, Matthew Murphy <mattmurphy@...rr.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> Jeroen van Meeuwen wrote:
> > Or you could just report the bug to the list...
>
> I would *NOT* encourage reporting the vulnerability straight to the
> list.  The advice I'd offer the OP is to report it individually, or use
> a coordinator or one of the services like VulnHelp that offer
> researchers assistance in vulnerability reporting.
>
> Truth-be-told, I'd encourage the use of coordinators if you have any
> hope for a resolution of a PHP security issue.  I find that the project
> seldom takes vulnerability reports seriously, preferring instead to
> ridicule researchers who contribute bug reports.
>
> In addition to the lack of professionalism commonly found amongst team
> members, the response process is poorly structured.  The project has no
> advisory mechanism in place to deal specifically with security issues.
> The team often does not credit reporters of security vulnerabilities or
> other bugs in its software, if they ever get fixed.  The supposed
> "process" is so ad hoc that even calling it a process is probably
> undeserved praise.
>
> Put simply: PHP's security processes lag far behind even its commercial
> competitors -- PHP is the Oracle of open-source and worse.  Dealing with
> them makes Microsoft and kin look like a cakewalk.
>
> - --
> "Social Darwinism: Try to make something idiot-proof,
> nature will provide you with a better idiot."
>
>                                -- Michael Holstein
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFDkINFfp4vUrVETTgRA1qMAKDLDNGB18dQ2TKCWhz4scL0O4FPxwCgzhpS
> r7RRj23hMLkXOcogHm9p958=
> =iKsq
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>