full-disclosure - Re: How much time is appropriate for fixing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120710144859.7c6cb6f3.gem@rellim.com>
Date: Tue, 10 Jul 2012 14:48:59 -0700
From: "Gary E. Miller" <gem@...lim.com>
To: Григорий Братислава
	<musntlive@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: How much time is appropriate for fixing

Yo Григорий!

On Tue, 10 Jul 2012 17:15:37 -0400
Григорий Братислава <musntlive@...il.com> wrote:

> >> People do not disclose their research to make
> >> the world a better place.  They do it for recognition or for money.
> >
> > I would argue there is a 3rd reason.  Self defense.  I and others
> > have had issues of our servers being attacked by unkown evil
> > doers.  To keep our servers running we need to reverse engineer the
> > hack and get the bug fixed or the attack vector blocked.  Until '*
> > Disclosure' in its many aspects was common it was virtually
> > impossible to get vendors to fix open holes being actively used by
> > attackers.  The public shaming of '* Disclosure' large companies
> > found denial a very easy and cheap resonse to bugs that were
> > killing us.

> Poor argument.

Maybe, but my real world example shows your simplistic logic is wrong.

>  If you is smart enough to is reverse engineer the
> threat, why can't you forward engineer a fix and post it publicly so
> that is others don't get hacked.

Who said I have not?  But since that is a non-sequiter to my counter
example to your argument, I'll leave that answer for another day.

> Public shaming of not only is vendor of shoddy software, but is
> attacker, is key no one is think about.

Psych 101: Evil people have no shame.  

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97701
	gem@...lim.com  Tel:+1(541)382-8588

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/