--- Feher Tamas <[EMAIL PROTECTED]> wrote: > Hello, > > >don't start a disclosure - non disclosure thread > again and again > >and again please... > > This is about responsible and non-responsible > disclosure, which is at > the heart of security research. > > As long as you have no proof that the bug is being > maliciously exploited > in the wild, you need to give time for the sw vendor > to react and patch.
If you are talking about a generic ethic, I sincerely agree. Slight deviations on this concept might apply depending on the vendor's track record and the vulnerability(I am not talking about MS alone). However, unfortunately, if you are familiar with the pattern in which MS handled the previous unpatched IE vulns, this looks like one of those IE vulns. that MS *WONT* patch. Nevertheless, putting the general public at such high risk is never a wise idea. -- S.G.Masood > > > What Zap the Dingbat has done will not earn him a > bust in the hall of > fame for security research. > > Sincerely: Tamas Feher. > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
