Re: HP Full Disclosure Story

[full-disclosure () lists netsys com (Georgi Guninski)]

Just take a look at real world.
When you buy a beer or a car and then find a bug in it, you may disclose the bug 
as you wish. (As bonus, both beer and cars come with warranties, unlike warez).

So what makes beer and cars so different than warez?

Or are you suggesting that if someone gets poisoned by a single buggy beer, they 
keep quiet for thirty days so the beer maker fix the bug silently?

Georgi Guninski
http://www.guninski.com


Steven M. Christey wrote:
> [the main parties have been blind CC'ed to ensure their awareness, but
> also so they don't receive double copies of responses to this email]
>
>
> Georgi Guninski said:
>
>
> > This clearly illustrates why the responsibility RFC is a really evil
> > thing.
> >
> > They are using funny arguments, but consider what threats they shall
> > make if they have a RFC at hand.
>
>
> I have broken down this scenario relative to the details of the
> Responsible Vulnerability Disclosure document.  It demonstrates that
> both parties have deviated from that document to some extent.
>
> As many have discussed on this list and elsewhere, every disclosure
> scenario is different, and it has been a challenge to try and cover
> reasonable scenarios in the RVD document (some have said that this
> means we shouldn't even try to write a document because of this, but
> I'm not so quick to give up.)  The current document does not cover
> everything that appears to have occurred in this case, however it does
> demonstrate a number of issues.