full-disclosure - Re: 0day Vulnerability in VLC (this is my first release of the vuln anywhere)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5176B523.70505@baribault.net>
Date: Tue, 23 Apr 2013 12:21:55 -0400
From: Gary Baribault <gary@...ibault.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: 0day Vulnerability in VLC (this is my first
 release of the vuln anywhere)

And oh so easy. Most of us know Georgi, but I do think it's unfair to
label all software firms as Terrorists. That term is used much too
easily these days IMHO. Sure some of them don't like to work with us,
but it has been my experience that most will, and if they don't, like
Valdis says, go from pale grey ball cap to darker grey, and to heck with
them, but at least you will have tried!

Gary Baribault
Courriel: gary@...ibault.net
GPG Key: 0x685430d1
Fingerprint: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1

On 04/23/2013 12:13 PM, Valdis.Kletnieks@...edu wrote:
> On Tue, 23 Apr 2013 17:51:55 +0300, Georgi Guninski said:
>> Completely disagree.
>>
>> IMHO nobody should bother negotiating with terrorist vendors.
>>
>> Q: What responsibility vendors have?
>> A: Zero. Check their disclaimers.
> And disclaimer or no disclaimer, there's a lot of vendors who want to
> Do The Right Thing and fix their stuff to protect their users (if for
> no other reason than the possibility of lost customers if they ignore
> security issues too often).
>
> If you're a black hat, do whatever the heck you want.
>
> If you're a white hat, be responsible and at least try to engage the
> vendor.  If you're worried about being stiffed for the credit for the
> find, write the advisory and post the MD5 hash somewhere before contacting
> the vendor.  If they respond and work on the problem, the process works.
> If they blow you off, go blackhat and do whatever the heck you want. :)
>
> Now wasn't that easy? :)
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/