full-disclosure - Re: Google open redirect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMZ4ocs0doafy3ZjgKtCXssQDYFWm50H76OiQ1aToM3CpUHodA@mail.gmail.com>
Date: Thu, 8 Dec 2011 16:37:57 -0300
From: Pablo Ximenes <pablo@...en.es>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk, Charles Morris <cmorris@...odu.edu>
Subject: Re: Google open redirect

I was assuming web vulns found in Google´s Infrastructure, and not
vulnerabilities in general as I imagine Google wouldn´t condone selling
vulns on their systems to the highest bidder.

As far as crimes commited during the process of discovering the vuln
itself, Google expressly authorizes security testing in the program:
http://www.google.com/about/corporate/company/rewardprogram.html

But for vulns in general, I totally agree with you.


2011/12/8 <Valdis.Kletnieks@...edu>

> On Thu, 08 Dec 2011 14:24:21 -0300, Pablo Ximenes said:
> > 2011/12/8 Michal Zalewski <lcamtuf@...edump.cx>
> > > If you don't like it, let us know how to improve it. You also always
> > > have the option of not researching vulnerabilities in these platforms;
> > > going with the full-disclosure approach; or selling the flaws to a
> > > willing third party.
>
> > Well, selling flaws to third parties might be considered a crime in some
> > places, so I would be cautious with that approach.
>
> I suspect a large portion of the people who are selling flaws to third
> parties
> are not at all concerned about whether selling the flaw is a crime, as
> often the
> bigger question is how many crimes were committed in the discovery
> process...
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/