There are two sides to this issue. 1. Releasing bug/vulnerability
information to the public will release hoards of script kiddies to cause
havoc and dismay instantaniously without recourse. 2. Releasing
bug/vulnerability information will cause industry leaders like Microsoft and
respectively Allaire to act on the information sooner than later.
I can see both sides of the fence but would lean to alerting the public to
the problem. Security by obscurity is not a good policy to live by.
Jeff
-----Original Message-----
From: Billy Cravens [mailto:[EMAIL PROTECTED]]
Sent: Thursday, December 21, 2000 1:38 PM
To: CF-Talk
Subject: Re: The +.htr bug strikes again
Don't you think it would have been better to wait until after Hasbro
patched it to alert a list of hundreds of developers? I often run
across cf sites with the htr bug (it's hardly uncommon). I usually
email the webmaster personally, as opposed to the "Hey guys! Look what
I found!"
Just out of curiosity (nothing against you Kevin): what are the legal
implications for something like this? Even if it's just a hole which a
person could find on their own, can pointing it out be a cause for
liability?
--
Billy Cravens
[EMAIL PROTECTED]
Kevin Schmidt wrote:
>
> Check out Hasbro Interactive. They run entirely CF and haven't patched
the
> +.htr bug yet. I alerted them to this fact.
>
> Kevin Schmidt, Web Technology Manager
> Allaire Certified Cold Fusion Developer
> pwb inc.
> integrated marketing communications
> 350 S. Main St., Suite 350
> Ann Arbor, MI 48104
> 734.995.5000 (tel)
> 734.995.5002 (fax)
> www.pwb.com
>
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Structure your ColdFusion code with Fusebox. Get the official book at
http://www.fusionauthority.com/bkinfo.cfm
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
