Of course you guys support full-disclosure

[full-disclosure () lists netsys com (Defender Defender)]

> On Sun, 25 Aug 2002 phc_exterminator () hushmail com wrote:
>
> > It's no wonder you guys have all these striking analogies about
> > why full-disclosure is inherently the work of God -- you are
> > all making money off it.
>
> Nope full disclosure is not the inherent work of god -- but it is the >best 
> solution we have at this time.

Necessary evil huh? Prefered argument of evil doers ;)

> > If you really cared so much about the security of the Internet,
> > you'd do it as a volunteer or work in the non-profit academic
> > arena. Otherwise, you have no choice but to defend to the death
> > the ideology that gives you your weekly income.
>
> Ahhh, so no one is allowed to have a job in something that they enjoy?
> Maybe you like flipping burgers then running home and owning some boxes
> but some of us have mortgages and families to support.  There is nothing 
> wrong with working in security or in IT.

Sorry, but I believe the poster refered to your common argument that 'all 
you want is help improve software, for free'.

> A lot of us have jobs because there are a lot of idiots out there that
> seem to think it is cool to deface websites, break into boxes, and
> willfully cause damage.  I know your next argument will be that this is a 
> result of full-disclosure giving the s'kiddiots the tools they need and in 
> some cases you are probably right (usually defacements) but there are many 
> others cases that would prove you wrong.

Like PHC and ~el8 hacks against security professionals?
You dont give them the tools on this one, you give them the motive ;)

> > The fact remains that the security industry is actually worse > than the 
> corporate greed of companies like Microsoft, because
> > while these vendors capitalize on need, perhaps without
> > business ethics, you guys capitalize on fear, which you do
> > everything possible to induce. It's basic business principles:
>
> You are right -- SOME -- security companies do just that.  But as hard as 
> it might be for you to believe, not all companies do this.

And not all security companies disclose bugs. Only those who want to expend 
their market by creating a threat. (hi iss!)

> > you create the need to harvest the profit. So essentially
> > you guys need to instill fear in the public in order to make
> > a quick buck. You also need to maintain a state of insecurity
> > in order to profit. It's as simple as that. If the Internet
> > was secure, you guys would go out of business. We don't want
> > that, do we?
>
> Thats bullshit, I personally would have no problem going back to general IT 
> work happy in the knowledge that my systems are "secure" -- but, because of 
> those who feel its necessary to constantly look for new ways to break into 
> boxes companies are going to constantly have the need to hire security 
> people.

What security-breakers you talk of here? You? ;)

> Tell me, based on the PHC definition of a hacker -- one who breaks into
> boxes, are you a hacker?
>
> If so, then I have to thank you for the long term employement you have
> given me.  You guys are not the solution, you are part of the problem.
> Maybe even the root cause.

I would not say root of the problem. But somehow, yes, they do justify your 
existence, and yes, that make them part of the problem. Worst is they 
justify their own existence by the existence of sellouts and full disclosure 
supporters, which make the problem an infinite loop.

Someone must break it some day.
Or just adopt new methods.





_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com