Re: [Full-Disclosure] To anybody who's offended by my disclosure policy
From: kf_lists (kf_lists_at_secnetops.com)
To: Berend-Jan Wever <firstname.lastname@example.org> Date: Fri, 26 Nov 2004 22:26:07 -0500
Berend-Jan Wever wrote:
>My disclosure policy:
>Most vendors treat "hackers" like free beta-testers that they can put the blame on when publicity goes bad.
Not only that ... some of the vendors even try to make you pay for a
support contract before you can report a security vulnerability. As a
researcher I can certainly understand his frustration with trying to
report a bug... sometimes it just gets to ya and you just don't give a
Vendors want the researchers to be the scape goat when a vulnerability
is found... standard procedure is: 1. Brush under the rug. 2. Try to
make the researcher look like a horrible person. 3. Downplay the
Stop trying to kill the messenger. Start holding your vendors
accountable! Give guys like Skylined a break... hes doing you a favor.
GOBBLE, GOBBLE. Happy Turkey Day!
Full-Disclosure - We believe in it.