Re: How much time is appropriate for fixing

["Gary E. Miller" <gem () rellim com>]

Yo Григорий!

On Tue, 10 Jul 2012 17:15:37 -0400
Григорий Братислава <musntlive () gmail com> wrote:

> > > People do not disclose their research to make
> > > the world a better place.  They do it for recognition or for money.
> >
> > I would argue there is a 3rd reason.  Self defense.  I and others
> > have had issues of our servers being attacked by unkown evil
> > doers.  To keep our servers running we need to reverse engineer the
> > hack and get the bug fixed or the attack vector blocked.  Until '*
> > Disclosure' in its many aspects was common it was virtually
> > impossible to get vendors to fix open holes being actively used by
> > attackers.  The public shaming of '* Disclosure' large companies
> > found denial a very easy and cheap resonse to bugs that were
> > killing us.

> Poor argument.

Maybe, but my real world example shows your simplistic logic is wrong.

>  If you is smart enough to is reverse engineer the
> threat, why can't you forward engineer a fix and post it publicly so
> that is others don't get hacked.

Who said I have not?  But since that is a non-sequiter to my counter
example to your argument, I'll leave that answer for another day.

> Public shaming of not only is vendor of shoddy software, but is
> attacker, is key no one is think about.

Psych 101: Evil people have no shame.  

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97701
        gem () rellim com  Tel:+1(541)382-8588

Attachment: signature.asc
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/