full-disclosure - Re: Vulnerabilities in *McAfee.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D948D20.8040102@ntlworld.com>
Date: Thu, 31 Mar 2011 15:18:08 +0100
From: Jacqui Caren-home <jacqui.caren@...world.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in *McAfee.com

On 31/03/2011 13:13, BlackHawk wrote:
> to close with a semi-serious joke: put all this together and you will
> know why black market selling of exploit is increasing his size: at
> least someone will appreciate your work and eventually recompensate
> you for it..

Everyone makes mistakes. Being unable to admit fault is a serious character
flaw for a developer. However for a business, this may be a commercially
sensible strategy.

A long time ago I was asked to demo a MAC web server memory leak to a .mil
address. I declined but provided the details and test script to the contact
and left him to run his own tests. The server turned into a linux box a few
months later. My worry was my demo would be construed as an attack by his
"higher ups".

A lot of businesses do not consider "constructive criticism" as positive and
will sometimes do everything in thier power to "PR" you to death - its
often seen as cheaper than fixing the problem.

Jacqui

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/