On Sun, 4 Apr 2004, Martin Bealby wrote: > I was thinking about the process of exploit release recently, due to the > case of the Frenchman publishing his finding of research into those > steganography programs, when I came upon a strange thought. > > If I find an exploit, and publish it straight away, I could annoy a > (possibly large) number of users, and the software developers. Although > I don't see how I could sensibly be attacked legally. > > However, if I find an exploit, notify developers, wait a certain time > period (also told to the developers), and the developers have not and > will not fix it, what can I do? If I publish anyway, wouldn't I be open > to possible blackmail charges? > > Which option would be best to follow? > > Personally, I think it's a difficult choice. Option one seems to cover > your own back but could lead to a large number of exploited machines, > while option two should (theoretically) lead to fewer exploited machines > (due to software updates), but could turn nasty. If I was faced with > this situation, I'm not sure what I would do. > > Cheers, > Martin
2 on the Troll-O-Meter. Thanks for playing though. -- "One of the nice things about ignorance is that it is curable. Unlike Neo-Conservatism. Eric Michael Cordian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
