----- Original Message -----
From: "M L Lynch [ SotG ]" <fredthe-debaters.com>
Date: Mon, 19 Aug 2002 15:38:12 +1000
To: <full-disclosurelists.netsys.com>
Subject: Re: [Full-Disclosure] (no subject)

> If you ever find a major security bug in a major piece of software, such as
> M$ software, approaching the vendor directly does not work. Quite often they
> will just add it to the end of the list of complaints, and might get around
> to it in some future patch... if they feel like it... and if they think the
> security bug you found posses great risk, they still won't fix it till they
> feel like doing it.. instead, they now know who you are... and they take
> subtle yet effective precautions to make sure you don't tell anyone about
> it. I know.

well then thats the company's problem isn't it. in a hypothetical situation like that you should be aiming your complaints not at the lack of a security industry but at the software developers idiotic business practices.
 
> Atleast if proof of concept is out there, and the risk is publicly known,
> they have some motivation to fix it, and the users of the product can take
> precautions to get around the bug until it is fixed.

not really. if the concept is out there but the vendor isn't going to do anything... then you're posing a greater security risk by having the vulnerability out there aren't you. forcing vendors to fix bugs by threatening to make those bugs public is a poor solution to shoddy workplace practices.

> Anyway, my thoughts.

interesting none the less

> Cheers

likewise

-- 
__________________________________________________________
Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]