Bugtraq mailing list archives
Re: It takes two to tango
From: woods () weird com (Greg A. Woods)
Date: Wed, 31 Jul 2002 11:15:27 -0400 (EDT)
[ On Wednesday, July 31, 2002 at 11:34:57 (+0100), Chris Paget wrote: ]
Subject: Re: It takes two to tango Does V still have the right to sue R?
Absolutely not. They were given more than fair notice.
If vendors are made liable for security holes, and those vendors have the right to sue the people who find advisories and / or release exploits, then we'll be seeing security researchers on the wrong end of multi-million dollar lawsuits.
Only if the law fails to recognize the notice given by the discoverer to the vendor. Perhaps security researchers should begin using registered mail to notify vendors. It probably also means that those who feel vendors do not deserve fair notice will (have to / continue to) resort to posting exploits anonymously.
IMHO, vendors SHOULD be responsible for security holes. However, before that can be done there needs to be some kind of law put in place to protect the researchers who find the holes.
IANAL, but I would hope no new laws are necessary -- the recognition of fair notice should be sufficient. -- Greg A. Woods +1 416 218-0098; <g.a.woods () ieee org>; <woods () robohack ca> Planix, Inc. <woods () planix com>; VE3TCP; Secrets of the Weird <woods () weird com>
Current thread:
- Re: It takes two to tango Riad S. Wahby (Jul 31)
- Re: It takes two to tango Derek D. Martin (Jul 31)
- it's all about timing Florin Andrei (Jul 31)
- Re: [Full-Disclosure] it's all about timing John Scimone (Aug 01)
- <Possible follow-ups>
- RE: It takes two to tango Scott, Richard (Jul 31)
- Re: It takes two to tango Greg A. Woods (Jul 31)
- Re: It takes two to tango Chris Paget (Jul 31)
- Re: It takes two to tango Tom Perrine (Jul 31)
- Re: It takes two to tango Branson Matheson (Jul 31)
- Re: It takes two to tango Kyle R. Hofmann (Jul 31)
- RE: It takes two to tango Mark L. Jackson (Jul 31)
- RE: It takes two to tango John Howie (Jul 31)
- Re: It takes two to tango Randy Hinders (Jul 31)
- Re: It takes two to tango Ltlw0lf (Aug 01)