[Full-Disclosure] CERT, Full Disclosure, and Security By Obscurity

From: Len Rose (len@netsys.com)
Date: 01/30/03

  • Next message: hellNbak: "RE: [Full-Disclosure] Re: Full Disclosure != Exploit Release" 
    From: Len Rose <len@netsys.com>
To: full-disclosure@lists.netsys.com
Date: Thu, 30 Jan 2003 09:22:07 -0500

    I'm not usually allowed to have an opinion since I moderate the list
    (in whatever sense that may mean for an unmoderated list) however,
    I would like to say something about CERT and revisit why we created this list.

    This list was created because we saw an ever-increasing trend to hide,
    delay, distort, and totally bury security information for commercial gains,
    or to protect certain priveleged entities (government, or paying customers)
    from security issues.

    As more and more security researchers make the crossover from research
    into commercial security provider the trend increases as their customers
    exert some pressure on them to stop releasing such dangerous information,
    or as they see a commercial advantage to only making the information available
    to those who will pay.

    Without condemning them at all, I have to point out that this often has an
    effect of leaving the rest of the internet community in the dark, often at
    the mercy of those who are privy to information that the average security
    person, or systems team can't possibly know without lists like Full Disclosure.

    With the recent evidence that CERT informed it's paying members about the
    Sapphire SQL worm before the rest of the world should now indicate that
    they too are not a useful resource for timely and open security information.

    As such, CERT has joined the list of special interest security entities for
    whom there are other agendas that take precedence over the interests of
    the internet community as a whole.

    Perhaps a new cooperative effort should take the place of CERT if it can
    avoid being prohibited from full disclosure by having it's funding tied
    to keeping private and government interests informeed at the expense of
    keeping the internet community informed of all security threats.

    In the knee-jerk reactions to the events on September 11, the Pax Americana
    campaigns around the globe, and now the recent march to Security By Obscurity,
    lists like Full Disclosure, and the security information it hopes to provide
    may well become illegal (at least here in the US)

    To summarize my opinion, I feel that security information must simply be
    made available to as many people as possible as quickly as possible, and
    let corporations, systems staff, and security professionals handle the
    problems. "The public has a right to know.." and any comparisons to
    dislosing national security technology to the full disclosure of software and
    network security problems should be totally ignored as they simply don't
    apply.

    (Gee, I never thought there would be such a thing as the Ivory Tower
     Security Establishment, but look, Ma.. they've all grown up..)

    Len

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    Relevant Pages

    • [fw-wiz] concerning ~el8 / project mayhem
      ... While not trying to spark a debate on the merits of or against full ... certainly it has been hashed over in this and other lists ... into the souls of some reputed security experts, leaving them to now, ... So, again, while not trying to spark that old full disclosure good/bad ...
      (Firewall-Wizards)
    • RE: PAWS security vulnerability
      ... FreeBSD security list" isn't grammatically correct. ... "I told you to post the patch and info to the appropriate FreeBSD security ... "...This point and others are often discussed on the mailing lists, ...
      (freebsd-questions)
    • [Full-Disclosure] Security Industry Under Scrutiny: Part One
      ... There has been a lot of "XYZ found a vuln simular to this blah blah blah" ... The problem isn't full disclosure. ... Back in the day I remember using the mailing lists to learn about security ...
      (Full-Disclosure)
    • May I have permission to travel???????
      ... ""Homeland Security Tightens Grip on International Travel ... The Department of Homeland Security proposed new rules back in July ... These lists ... Instead of providing a passenger manifest after departure as now ...
      (alt.true-crime)
    • RE: PAWS security vulnerability
      ... You STILL haven't taken this to the correct security mailing list, ... > FreeBSD security ... >>lists, and you aren't the least bit interested in doing what ... >>appropriate forum to post the patch, ...
      (freebsd-questions)