lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a56479a50706201920o74f879ceucf86cf1bfaec146e@mail.gmail.com>
Date: Thu, 21 Jun 2007 03:20:24 +0100
From: "HACK THE GOV" <hackthegov@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Month of Random Hashes: DAY TWELVE

 " From: n3td3v < <http://seclists.org/fulldisclosure/2006/Dec/0382.html>
xploitable_at_gmail.com<xploitable_at_gmail.com?Subject=Re:%20n3td3v%20calls%20on%20month%20of%20bug%20campaigns%20to%20stop>>

Date: Wed, 20 Dec 2006 21:38:38 +0000

[introduction]
n3td3v is deeply sad at the new trend of morally accepted blackmail by
the security community, known better as a month of bugs.

sincere researchers are coming forward more frequently to threaten
companies with a month of vendor bugs.

because they are known to be sincere they are morally left off the
hook from what is known by n3td3v to be straight forward blackmail.

blackmail is illegal, for this reason n3td3v wishes to make the
following recommendations:

[1]bug a day for a month campaigns are blackmail on the part of the
researcher, all should be outlawed by government.

[2]n3td3v calls on the government to make it highly illegal and
morally unacceptable to threaten a month of bugs for a vendor and its
customers

[3]security researchers think its "fun" but all it amounts to is blackmail

[4]all blackmail attempts shouldn't be dressed up as harmless fun

[5]governments need to wake up and swiftly arrest those making month
of bug claims in the future

[6]corporations and its consumers shouldn't be scared mongered and
threatened by individuals

[7]researchers shouldn't use their real name or real place of
employment and expect exclusion from legal action against blackmail

[8]researchers shouldn't be allowed to profit or gain career
opportunities by such claims to action by the researcher

[9]researchers should be taken into custody, questioned and have their
hardware obtained for forensic analysis before a month of bugs is due
to start

[10]individuals threatening to carry out a month of bugs shouldn't be
labelled as "security researchers" by the media and security experts

[11]such individuals should be clearly labelled as "criminals",
"malicious attackers" and "blackhats", no matter what other "friendly"
or "useful" research they've carried out in the past.

[media dork reference]
<http://seclists.org/fulldisclosure/2006/Dec/0382.html>
http://news.com.com/2061-10793_3-6144833.html
<http://seclists.org/fulldisclosure/2006/Dec/0382.html>

"

link: http://seclists.org/fulldisclosure/2006/Dec/0382.html

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ