Re: [Full-Disclosure] RE: Disclosure policy in Re: RealPlayer vulnerabilities

From: Tim Johnson (tjohnson_at_SANDISK.COM)
Date: 10/08/04

  • Next message: Martin Viktora: "Re: [Full-Disclosure] RE: Disclosure policy in Re: RealPlayer vulnerabilities" 
    Date:         Fri, 8 Oct 2004 09:58:56 -0700
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

            Actually, this is overly simplistic. Especially when we are
    dealing with home users, immediate disclosure to the public is
    irresponsible.

            My parents are not subscribed to this or any other security
    bulletin mailing list, for example, and even though I try to keep them
    as up to date as possible, the chances that they are going to be able to
    update their system immediately is pretty slim unless we're talking
    about a patch distributed via AU. The implication that they chose not to
    heed the warning is ludicrous.

            But even in the case of a business, assuming that everyone can
    just apply every patch that comes down the pipe blindly and hope for the
    best is unreasonable.

            Like Drew, I believe in Full Disclosure. But are you really
    telling me that it is reasonable to give the vendor time to test a
    patch, but not the end users?

    -----Original Message-----
    From: Windows NTBugtraq Mailing List
    [mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM] On Behalf Of Jason Coombs PivX
    Solutions
    Sent: Thursday, October 07, 2004 5:00 PM
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    Subject: Re: [Full-Disclosure] RE: Disclosure policy in Re: RealPlayer
    vulnerabilities

    Drew Copley wrote:
    > ... ... ... ... ... ..., and, ... ... ...

    Drew,

    <snip>

    To disclose, or not to disclose. That is the question.

    <snip>

    Immediate full disclosure that cannot be disputed and leaves no room for
    debate immediately helps anyone who chooses to receive and consider the
    disclosure. Everything else serves only to delay and obscure that clear
    and urgent security alert communique, increasing the window of exposure
    and the Total Risk of Ownership needlessly.

    <snip> 

    --
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
--
  • Next message: Martin Viktora: "Re: [Full-Disclosure] RE: Disclosure policy in Re: RealPlayer vulnerabilities"