Re: bind 8 info update regarding ISS

From: Georgi Guninski (guninski@GUNINSKI.COM)
Date: 11/18/02

  • Next message: Karan Mavai: "FW: Improvements to Microsoft Security Reponse Communications" 
    Date:         Mon, 18 Nov 2002 20:44:41 +0200
From: Georgi Guninski <guninski@GUNINSKI.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Russ wrote:

    > Note: The Bugtraq Moderator has informed me that this topic has been closed,
    > but they have graciously allowed me an opportunity to respond to statements
    > made directly at me by mark_sala@yahoo.com.
    >
    > Mark said;
    > "In the end, I'd rather have a security company find the vulnerabilities and
    > work with the vendor to fix, then to stay in the dark and let the holes stay
    > open for intruders to exploit."
    >
    > Where is it stated that there are only two options here? The OIS was formed
    > with the stated goal of defining best practices when it comes to disclosure.
    > This not only suggests there are many (e.g. more than two options), but also
    > that there's disagreement in the community (both the industry and userbase) as
    > to what should be done. Even Mike Warfield's note states there is a fine line
    > and you can never do the "right thing".

    I don't understand why instead of finding bugs you whine about responsibility
    issues - be a real surgeon and kill a bug.
    Personally don't care why the OIS was formed, but I am glad ISS disclose bugs
    instead of following some rules of organization of which microsoft is member.

    I'd like to question the trustworthiness of
    http://www.oisafety.org/

    Georgi Guninski
    http://www.guninski.com

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Demonstrate your knowledge and understanding of core IT Security, become
    TICSA certified.

    Are you responsible for IT security in job function, but not necessarily
    in title? Do you want to prove your IT security knowledge and increase
    opportunities? Interested? Visit;

    http://www.trusecure.com/solutions/certifications/ticsa/

    for more information.
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

    Relevant Pages