Setting aside analogies, the questions remain: Does full disclosure make the IT community as whole less secure than it would otherwise would be? Is it more dangerous to have a handfull of sophisticated blackhats lurking about with an unknown exploit vs. publishing it for every wannabe hacker to use? I am confident that the answer is that fully disclosing discovered vulnerabilites without first giving the vendor a reasonable chance to address them is more harmful. There is no question that vendors, particulary Microsoft, have a history of neglect in this area, and folks have a right to be angry with them. Unfortunately, full disclosure doesn't hurt them as much as it hurts the information security community as a whole. While not patronizing the vendor because of the neglect is the most logical choice, it is an impracticality for many. I don't question the right or ethics of full disclosure. It's just pain in the neck that might otherwise be avoided or at least minimized. It's not helping.
-----Original Message----- From: Larry Seltzer [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 4:34 PM To: [EMAIL PROTECTED]; 'Tim Bilbro' Cc: [email protected] Subject: RE: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability There aren't people out there looking to exploit the flaws in your car in order to drive it where they want it to go. It's a lousy analogy. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blog.eweek.com/blogs/larry%5Fseltzer/ Contributing Editor, PC Magazine [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 4:25 PM To: Tim Bilbro Cc: [email protected] Subject: Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability Hi Tim, Perhaps instead of viewing this as breaking into locked doors and look at it as consumer product information, such as problems with my automobile, it would not appear as such a big deal. I like product recalls and keeping vendors honest. Product safety has improved significantly over the past 20 years because of the openness of the flaws. I am sure that software has and will continue to benefit from full disclosure of their flaws. cheers, bob On Wed, 26 Apr 2006, Tim Bilbro wrote: > You do a disservice to all IT shops by announcing these > vulnerabilities before contacting the vendor. I am sure it would not > generate as much web traffic to your site, but it is only fair and > right to allow at least some amount of time for the vendor to respond. > If you think you are helping, you are wrong. Would you go around town > checking which stores are unlocked at night and then publish the list > in the news before letting the shop owners know? That's pretty much > what you are doing. It's just not helping. There is no proof that it is either. > > Tim Bilbro > Information Security Specialist > CISSP, MCSE > [EMAIL PROTECTED] > web: www.bloglines.com/blog/Bilbro > RSS: www.bloglines.com/blog/Bilbro/rss > > -- Bob Bruen Cold Rain Technologies http://coldrain.net +1.802.579.6288 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
