Full Disclosure mailing list archives
Re: IE7 Zero Day
From: n3td3v <n3td3v () gmail com>
Date: Sun, 7 May 2006 21:59:47 +0100
On 5/7/06, 0x80 () hush ai <0x80 () hush ai> wrote:
>Have you e-mailed secure () microsoft com and asked them if they want >to >make an offer? I know they've done private deals with security >researchers in the past, and trust me, they were offered a lot >more No I have not emailed Microsoft. They are not entitled to any exlusivity.
Why not? Its their software that has the bug and they're the only ones who can fix it. Its not just Microsoft you're going against here, its the millions of Microsoft users you're holding to ransom here.
>illegal auction. I think its in your best interest to e-mail >secure () microsoft com. Illegal? Tell me what law in what country I have broken.
Tell me which country you're in, and then we can talk about how illegal your ransom against Microsoft and its consumers is.
> >1) You don't want to make as much money as you could by offering >Microsoft to buy your vulnerability in private. Like I said. MS can offer just like anyone else but they do not get any special treatment.
Thats not the way it works. You must contact Microsoft first to setup a dialog between each other.
>2) You want to be held responsible for selling an exploit which >leads >to a major incident, worm, virus outrage. The vulnerabilities I have for sale could be used in such a way but I am in no way responsible for what the purhcaser uses it for.
Don't be so sure of your legal saftey. I don't think you would ever get the chance to risk a major incident, you would just be arrested, have the money and vulnerability handed to Microsoft and you slammed into jail. Any which way, you're going to be the loser out of this, not Microsoft. Trust me, the intelligence services are already monitoring communications between you and anyone else regarding your sale, do the right thing, save your own skin, e-mail secure () microsoft com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: IE7 Zero Day, (continued)
- Re: IE7 Zero Day 0x80 (May 05)
- Re: IE7 Zero Day Ryan Whelan (May 05)
- Re: IE7 Zero Day 0x80 (May 05)
- Re: IE7 Zero Day daniel uriah clemens (May 05)
- Re: IE7 Zero Day Dave Alanis (May 05)
- Re: IE7 Zero Day 0x80 (May 06)
- Re: IE7 Zero Day FRLinux (May 06)
- Re: IE7 Zero Day naveed (May 07)
- Re: Re: IE7 Zero Day ad () heapoverflow com (May 07)
- Re: IE7 Zero Day 0x80 (May 07)
- Re: IE7 Zero Day n3td3v (May 07)
- Re: IE7 Zero Day bkfsec (May 10)
- Re: IE7 Zero Day 0x80 (May 07)
- Re: IE7 Zero Day 0x80 (May 07)
- Re: IE7 Zero Day n3td3v (May 08)
- Re: IE7 Zero Day Ducki3 (May 09)
- Re: IE7 Zero Day n3td3v (May 08)
- Re: IE7 Zero Day 0x80 (May 09)
- Re: IE7 Zero Day 0x80 (May 05)