full-disclosure - Re: Re[2]: FYI: Pay for disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 2 Aug 2006 15:54:28 -0500
From: "John Dietz" <www.whitewolf@...il.com>
To: "Thierry Zoller" <Thierry@...ler.lu>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Re[2]: FYI: Pay for disclosure

I agree, it does seem a lot like extortion the way they present it on that
site, but putting myself in their shoes, I'm having a hard time figuring a
way to get paid for all my hard work without it sounding so much like
extortion.  One thing for sure I would change is the 30-day deal.  The only
real way to be fair (and legitimate) on this subject is to treat it like any
other merchandise.  Either offer it one time for one lump fee to the first
buyer or sell it for one reduced rate to everyone who wants to buy it.  I
can see where they would want the vendor to have some extra time to fix the
issue before releasing it to anyone else, but this is walking a fine line
towards extortion.  Best bet would be consult a lawyer before doing anything
like this...

On 8/2/06, Thierry Zoller <Thierry@...ler.lu> wrote:
>
> Dear List,
>
> Just to be a bit more clearer, I am not opposed to being paid for the
> research one did, I just find it astonishing to read "If the vendor
> buys the analysis it is given 30 days protection for all
> private information included in this analysis."
>
> This sounds a bit like the mob to me, "protection money".
>
>
>
> --
> http://secdev.zoller.lu
> Thierry Zoller
> Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
There is intelligence is in having all the answers, but wisdom lies in
knowing which of the questions to answer.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/