From: Matt Palmer (mpalmerhezmatt.org)
Date: Tue Jul 26 2005 - 21:23:58 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, Jul 25, 2005 at 02:03:51PM +0000, Ghaith Nasrawi wrote:
> as it was announced few minutes ago that "3Com launches
> vulnerability-buying program" (through TippingPoint, a company 3Com
> acquired earlier this year)
>
> http://www.securityfocus.com/news/11253
> http://www.zerodayinitiative.com/
>
> so what do you think about this step? Obviously, they are trying to
> fight public disclosure of security vunl's (that why bugtraq exists)
> and buy the information so they can have 0day signatures to
> TippingPoint IPS solution.

It's probably pretty good for TippingPoint customers. Seems pretty
reasonable from a commercial point-of-view -- if enough extra people buy the
software to offset the cost of the purchases, then it's a win for 3Com. I
doubt that they'll be offering the sort of money that is going to make a
real clueful zombiemaster roll over and play ball, however, so in the same
way that paying police informants hasn't eradicated crime, I don't think
this is going to be a solution to the problem. It's an interesting take on
the situation, though.

- Matt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFC5vA+BEnrTWk1E4cRAnwGAJ4i2o/f+P63PBxN6RPMBA/ohzLRXQCfcgzV
y6Auy2S7gAVMVzdh39KAxEc=
=f7Ol
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]