full-disclosure - Re: Web Application Security Awareness Day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 18 Apr 2008 10:24:12 +0100
From: "Ven Ted" <v3nt3d@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Web Application Security Awareness Day

[introduction]
v3nt3d is deeply sad at the new trend of morally accepted blackmail by
researchers, known better as a web application security awareness day.

sincere researchers are coming forward more frequently to threaten companies
with a web application security awareness day.

because they are known to be sincere they are morally left off the hook from
what is known by v3nt3d to be straight forward blackmail.

blackmail is illegal, for this reason v3nt3d wishes to make the following
recommendations:

[1]web application security awareness day campaigns are blackmail on the
part of the researcher, all should be outlawed by government.

[2]v3nt3d calls on the government to make it highly illegal and morally
unacceptable to threaten a web application security awareness day for a
vendor and its customers

[3]security researchers think its "fun" but all it amounts to is blackmail

[4]all blackmail attempts shouldn't be dressed up as harmless fun

[5]governments need to wake up and swiftly arrest those making  web
application security awareness day claims in the future

[6]corporations and its consumers shouldn't be scared mongered and
threatened by individuals

[7]researchers shouldn't use their real name or real place of employment and
expect exclusion from legal action against blackmail

[8]researchers shouldn't be allowed to profit or gain career opportunities
by such claims to action by the researcher

[9]researchers should be taken into custody, questioned and have their
hardware obtained for forensic analysis before a web application security
awareness day is due to start

[10]individuals threatening to carry out a web application security
awareness day shouldn't be labelled as "security researchers" by the media
and security experts

[11]such individuals should be clearly labelled as "criminals", "malicious
attackers" and "blackhats", no matter what other "friendly" or "useful"
research they've carried out in the past.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/