lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat Apr 22 22:40:30 2006
From: drfrancky at securax.org (Javor Ninov)
Subject: Who Do I Contact?

Then what is the meaning of "Full Disclosure" ?

--
Javor Ninov aka DrFrancky
http://securitydot.net/

Don Bailey wrote:
>>> "If the vendor refuses to act upon the news of the vulnerability, then 
>>> Full Disclosure is in order."  (don't release the numbers of course 
>>> but release a generic statement that "this" universtity is not secure.
>>>
> 
> Is this a joke? Absolutely do *not* implement full disclosure. Doing
> so will cause unnecessary and probable exposure of private
> information.
> 
> First, contact the university's IT department. If that doesn't work,
> contact a regent of the university. They will put you in touch
> with an individual that can fix the problem. There is no reason
> to reveal the university to parties that have no business with
> said information. Public forums only disclose information to
> people that have no right to that information. You can not
> control the actions individuals in the public have.
> 
> Risking the privacy of innocent students and faculty is not
> the proper means to solve a problem.
> 
> Do you want X number of script kids pounding a university
> causing them more problems?
> 
>>> Send a copy of the email to the University.  Might want to include 
>>> their local TV news as well.  You'd be surprised how the alumni will 
>>> react to get that fixed.
>>>
> 
> What are you, a media whore?
> 
>>> In order to give them one more shot you may wish to tell them on which 
>>> date it will be publically released.
>>>
> 
> Ridiculous.
> 
> Don "north" Bailey
> 
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060423/e5e7dd67/signature.bin

Powered by blists - more mailing lists