lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu Apr 27 14:43:15 2006 From: str0ke at milw0rm.com (str0ke) Subject: MSIE (mshtml.dll) OBJECT tag vulnerability This isn't the whitehat lovers group, anything and everything goes for Full Disclosure. > "Just who does he think he is? [...] Zalewski may think > he's some sort of hero disclosing this information, but his is the act of a vandal. No a vandal wouldn't disclose the information, a vandal on the other hand would sell the information / code to spyware companies. Hmm, think about it. The funny part about this whole situation is that the people that bashed on MZ never contributed a pea to what he has to this list. /str0ke On 4/27/06, Pedro Hugo <fractalg@...hspeedweb.net> wrote: > > "Just who does he think he is? [...] Zalewski may think he's some sort > of hero disclosing this information, but his is the act of a vandal. > If > > it turns out that the bug is exploitable and abused before it's > patched, > > then perhaps he'll be proud to be remembered for that." > > He is what he wants to be... Afaik, there are no laws about disclosure. > Everyone does what he thinks it's best, even if it's best only for himself > (like Adam Smith "said", everyone acts on their own interest). > The bug requires user interaction. If most users are too stupid to click > anything, the problem will not be solved with patching. > And, even with patches, can you estimate what percentage of systems which > are patched right away ? Yeah, most aren't! > > No sysadmin likes to be catched by surprise with security problems. But, > life isn't always perfect ! > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
Powered by blists - more mailing lists