Re: It takes two to tango

From: Randy Hinders (rahinders@hotmail.com)
Date: 07/31/02 

From: "Randy Hinders" <rahinders@hotmail.com>
To: bugtraq@securityfocus.com
Date: Wed, 31 Jul 2002 15:56:30 -0400

As much as it pains me to say this, I feel I must (for sake of argument).
There is an assumed risk in using any product. The different analogies that
people are coming up with are ludicrous. Given the current political and
prejudice* situations, litigation in the courts is not the way to go. Our
great nation was founded with freedom in mind, and this freedom is what we
try to assist other nations in achieving. It is this Freedom that allows
our open market and Freedom of speech. Our freedom of speech may or may not
infringe upon a companies “intellectual property”. Would we all be in
agreement that no one else took apart the Wright Brothers first Bi-Plane and
then reassembled it using their own tweaks? No, I don’t think so. The
Wright Brothers and other Great Minds from the generation before us shared
their ideas for the benefit of the common good. Proof of this is the
existence of the Engineers Club of Dayton Ohio. Back in the day, if people
didn’t like what product ABC did or did not do they used the freedom of an
open market to purchase someone else’s product or they used their freedom of
independent thinking to create a better ABC.

That is what we need to do. Boycott the vendor who does not work with the
consumer watchdogs. Should a vulnerability be found “Without criminal
intent” a message of said vulnerabilities should be sent to the watchdogs
who then work with the vendors. The vendors should make a “reasonable
effort” to reproduce the vulnerability (after all the watchdog is most
likely going to reproduce it so the vendor should be able to reproduce it).
If the vendor fails to take appropriate actions then the vendor should be
placed on a black list. The consumers (you and me) then do not purchase
items from those vendors. However, we do not need to overwhelm our judicial
system with frivolous lawsuits because it is US the consumers who need to
ASSUME the risk of making any information public.

We all know the only way to have a totally secure system is to not turn it
on. Knowing this we must assume that risk and let our customers know the
risk. Or it will come down to suing the local news station for announcing
the severe lighting storm which in turn struck the office causing a surge
which melted the CPU onto the motherboard causing a downtime of 4 hours.
During these 4 hours employees were not able to utilize the computer system
thus causing a loss of wages…. Come on people…. It is like the cold war
scenario all aver again “I can blow your country up more time than you can
blow my country up”.

No one wins. However, do not under estimate the power of your dollar, which
is a war that can (and is daily) be won.

Randy Hinders

* Prejudices = as in an irrational attitude to sue over the pettiest of
things to include someone feelings being hurt… life is hard and it sometimes
sucks, get used to it.

_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail.
http://www.hotmail.com

Relevant Pages

  • Re: Decompiler.NET reverse engineers your CLS compliant code
    ... > much of a risk that you may get hit by a bus tomorrow and won't need the ... of becoming useless in the unfortunate case that the vendor dissappears. ... >> with that kind of licensing. ... It does nothing to keep prices low ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Stand up and be counted - BSDStats Project
    ... Internet SP ... because it is no longer a freedom. ... vendor that created it and ask them why they don't ... releasing the specs just to shut these people up. ...
    (freebsd-questions)
  • Re: [Full-disclosure] To disclose or not to disclose
    ... If the issue really involves critical infrastructure you can ... organizations to step in and pressure the vendor to fix the issue ... put the security companies customer at risk. ...
    (Full-Disclosure)
  • To Provide a Patch or to Service Pack?
    ... information and assessed the risk to me and my organization, ... So what are the motivations for going down the service pack path as oppossed ... The vendor is attempting to save money which is not a bad thing. ... customers will not be greatly exposed to any risk so it is generally safe to ...
    (Bugtraq)
  • PayPal -- was "Ideas for my site/workbook"
    ... Virtually every vendor you purchase something from on-line requires you to set ... So why is setting up a PayPal account ONCE perceived as such a barrier, ... reduces risk of on-line fraud so much? ...
    (borland.public.delphi.non-technical)