full-disclosure - Re: 0day Vulnerability in VLC (this is my first release of the vuln anywhere)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5176BCD2.9010603@baribault.net>
Date: Tue, 23 Apr 2013 12:54:42 -0400
From: Gary Baribault <gary@...ibault.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: 0day Vulnerability in VLC (this is my first
 release of the vuln anywhere)

And any vendor who says it will take 18 months to fix this, tough, give
them whatever you feel is reasonable, tell them when you will be
releasing and then go, but keep in mind, fixing a bug that affects
Windows XP, Vista, 7, 8, 2003, 2008 and 2012 will take longer than
fixing a bug in VLC. Yes we are all adults and have to make our own
decisions, but when some of us act impulsively, it hurts all of our
reputations. In the end, I hope we are all here for our users and customers.

Gary Baribault
Courriel: gary@...ibault.net
GPG Key: 0x685430d1
Fingerprint: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1

On 04/23/2013 12:39 PM, Taylor Burke wrote:
> Someone earlier (in another thread?) mentioned notifying the vendor
> first and, if they don't respond within a week or some other
> reasonable period of time, going public with the 0day and a clear
> conscious. And I completely agree- at least make an effort to let the
> vendor know before you go public.
>
> On 13-04-23 10:51 AM, Georgi Guninski wrote:
>> Completely disagree.
>>
>> IMHO nobody should bother negotiating with terrorist vendors.
>>
>> Q: What responsibility vendors have?
>> A: Zero. Check their disclaimers.
>>
>>
>> On Tue, Apr 23, 2013 at 04:14:53PM +0200, Gregory Boddin wrote:
>>> That's indeed not rocket science.
>>>
>>> Nobody should release their disclosure/exploit (or give hint about
>>> it) in
>>> the wild before letting the vendor fix it.
>>>
>>> There's already enough blackhats out there selling/using those.
>>>
>>> I sure hope I am not the only person in the list who wishes responsible
>>>> disclosure.
>>>>
>>>> ---
>>>> Henri Salo
>>>>
>>>> -----BEGIN PGP SIGNATURE-----
>>>> Version: GnuPG v1.4.10 (GNU/Linux)
>>>>
>>>> iEYEARECAAYFAlF2eWAACgkQXf6hBi6kbk8p+QCgkrzZnNpipCMC/kexFq8OR3Q2
>>>> NiIAnRMYicxFqmJhvjLIEZolEKjQcEEE
>>>> =q78V
>>>> -----END PGP SIGNATURE-----
>>>>
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/