Re: [Full-Disclosure] To anybody who's offended by my disclosure policy

From: kf_lists (kf_lists_at_secnetops.com)
Date: 11/27/04

  • Next message: class 101: "Re: [Full-Disclosure] Immunity, Inc. Advisor"
    To: Berend-Jan Wever <skylined@edup.tudelft.nl>
    Date: Fri, 26 Nov 2004 22:26:07 -0500
    
    

    Berend-Jan Wever wrote:

    >My disclosure policy:
    >Most vendors treat "hackers" like free beta-testers that they can put the blame on when publicity goes bad.
    >
    Not only that ... some of the vendors even try to make you pay for a
    support contract before you can report a security vulnerability. As a
    researcher I can certainly understand his frustration with trying to
    report a bug... sometimes it just gets to ya and you just don't give a
    flying whoot.

    Vendors want the researchers to be the scape goat when a vulnerability
    is found... standard procedure is: 1. Brush under the rug. 2. Try to
    make the researcher look like a horrible person. 3. Downplay the
    vulnerability.

    Stop trying to kill the messenger. Start holding your vendors
    accountable! Give guys like Skylined a break... hes doing you a favor.

    GOBBLE, GOBBLE. Happy Turkey Day!
    -KF

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: class 101: "Re: [Full-Disclosure] Immunity, Inc. Advisor"

    Relevant Pages

    • Re: It takes two to tango
      ... In publishing an exploit for said vulnerability, a consumer is in a sense ... and my goal of being a security researcher is far ... If vendors are made liable for ... >security holes, and those vendors have the right to sue the people who ...
      (Bugtraq)
    • Towards a responsible vulnerability process
      ... I work closely with the vulnerability response process at Microsoft, ... vendors" is being hopelessly overly general. ... and not all of them lead to widespread attacks. ...
      (NT-Bugtraq)
    • Re: Three formats for one report
      ... I will only be running the report about once a month, ... The source query looks at expiration dates on certificates and other ... and contains messages to several vendors. ... a Supply vendor the appropriate survey subreport needs to be part of the ...
      (microsoft.public.access.reports)
    • CERT Advisory CA-2002-10 Format String Vulnerability in rpc.rwalld
      ... A format string vulnerability may permit an intruder to ... execute code with the privileges of the rwall daemon. ... which would trigger the rwall daemon's error message. ... Appendix A contains information provided by vendors for this advisory. ...
      (Cert)
    • CERT Advisory CA-2002-10 Format String Vulnerability in rpc.rwalld
      ... A format string vulnerability may permit an intruder to ... execute code with the privileges of the rwall daemon. ... which would trigger the rwall daemon's error message. ... Appendix A contains information provided by vendors for this advisory. ...
      (Cert)