full-disclosure - Re: How much time is appropriate for fixing a bug?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120709102011.GA1988@sivokote.iziade.m$>
Date: Mon, 9 Jul 2012 13:20:11 +0300
From: Georgi Guninski <guninski@...inski.com>
To: Stefan Kanthak <stefan.kanthak@...go.de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: How much time is appropriate for fixing a bug?

On Sun, Jul 08, 2012 at 02:07:52PM +0200, Stefan Kanthak wrote:
> "Thor (Hammer of God)" <thor@...merofgod.com> wrote:
> 
> | Content-Type: multipart/mixed; boundary="===============0734760750=="
> 
> Please stop posting anything but text/plain.
> 
> > If you really care about the security of the industry, then submit it and
> > be done with it.  If and when they fix it is up to them.
> 
> OUCH!?
> The "industry" will (typically) not fix any error if the cost for fixing
> exceeds the loss (or revenue) that this fix creates, including the vendors
> gain/loss of reputation, gain/loss of stock value, loss of money in court
> cases or due to compensations, loss of (future) sales due to (dis-)satisfied
> customers, ...
> 
> Joe Average can't tell the difference between a program which is designed,
> developed, built and maintained according to the state of the art, and some
> piece of crap that is not. He but only sees the (nice or promising) GUI of
> the product and it's price tag.
> 
> Stefan Kanthak
>

i agree that Thor is writing pure corporate crap.

note that he is contradicting himself: in another thread he
wrote basically "people do stuff for money and getting laid".

in this thread he is using the buzzwords "self promotion"/
"ego-substantiation" which don't appear to fit the above model
of motivation and are certainly wrong for most members of FD.

probably in the next thread he will use the buzzword "irresponsible".

i suppose in his glass house world he expects hackers to give the
0days to vendors and keep silent, busting vendors profits for free
so they don't accused of the ego related irresponsible crimes.

f*ck it, i expect the final usa crisis to partially fix the model.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/