full-disclosure - Responsibility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAA24eKuEkK0U2NuVRIYlKGfcKAAAAQAAAAuJTDCKOtREOBdfGHP43W9AEAAAAA@pchandyman.com.au>
Date: Sun May 21 23:05:56 2006
From: full-disclosure3 at pchandyman.com.au (Greg)
Subject: Responsibility

Large motel/hotel chain I recently acquired wants to sue previous company
who did their I.T. work for them as a customer's wifi connected machine
infected their network and caused loss of booking data thus money.

My question then is - if you have done the utmost to lock down your customer
but someone connects an infected machine and somehow it gets in, is the
customer right in suing you? Eg, like a car mechanic, you do the best but
you cannot be 100% sure that something else that was never a problem will
now cause a problem (such as a new exploit in our case that wasn't known
generally until 24 hours ago). Should you be sued at that point?

Wondering whether to dump the guy at this point.

Thanks.