full-disclosure - Re: Vulnerabilities in *McAfee.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=EhXCajTi9Y8XrmQkp_Wviy15ZrTbBk91KB3Rs@mail.gmail.com>
Date: Wed, 30 Mar 2011 17:28:59 -0400
From: Jeffrey Walton <noloader@...il.com>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Vulnerabilities in *McAfee.com

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor@...merofgod.com> wrote:
> I have that very strip printed and on the wall in my office :)    You make several points, but the response that immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding vulnerabilities, and entering data in a search box.  I don't know if there is any basis for this legally, but I feel that if you put a box up and I can search for something, then I can put whatever I want in that box.  You (the royal you) are basically soliciting people to put data in the box.   However, you are not asking anyone to spider your site or run scans against it.
>
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/