Re: recent disclosure debates

[Barney Wolff <barney () tp databus com>]

On Sun, Dec 15, 2002 at 09:14:53PM -0500, R. DuFresne wrote:
> This posting was pretty enlightening on the issue:

Well, no, it wasn't.  Despite all the verbiage, the fact remains that
ISS released the vulnerability before patches were available to many
or most of the people who needed them.  If ISC actually refused to
release the patches until after the notice, one would think ISS would
have said that, but they didn't.  So I'm forced to conclude that they
released the notice on the scheduled day without checking that ISC
had actually released the patches.  Both parties look very bad, but ISS
is the one more immediately at fault for the premature release, imho.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards