Full Disclosure mailing list archives
RE: CERT, Full Disclosure, and Security By Obsc urity
From: Arjen De Landgraaf <arjen.de.landgraaf () cologic co nz>
Date: Sun, 2 Feb 2003 18:20:30 +1300
NZ is an ideal place, has some significant advantages; geographical time difference, good comms infrastructure, stable economy and great local talent etc. We run a commercial service, www.e-secure-it.us to keep us alive. Although the commercial aspects have generated many rants and raves, reality is that either we find a sponsor (often commercial security firm, with all the (subjectivity) disadvantages), or run it, as many do, on a shoestring, with (frequently changing) donated server space, bandwidth etc., lives devoted to trying to keep up with 24 x 7 x 365 monitoring, as massive undertaking, as we know out of three years of experience, real-time data entry and maintaining of a (well over 2 gig database etc). Having to find that time and qualified people from somewhere. Believe me, as a commercial service you have exactly the same issues, especially with a small local market as New Zealand. As an example of the ongoing cost to run a free service, only the free E-Secure-DB traffic already costs us NZ$3000 each month in bandwidth!!!!! In my experience only a commercial base can give such a significant undertaking any long-term stability. We are currently almost able to survive, as the design, outlay and operation of E-Secure-IT has all been funded out of our own pockets, and, although we have no spare money to create sufficient awareness outside of New Zealand, we are growing; word of mouth is getting out now. FI. eEurope Action Plan; http://www.content-village.org/articles.asp?id=332 and http://www.content-village.org/articles.asp?id=333 ) As we are totally committed to contributing to a save Internet, we could open up part of E-Secure-IT itself (as we have now with Security News) for free access in a (moderated) posting format, links and files, as long as this model would work for us all. Arjen New Zealand -----Original Message----- From: yossarian [mailto:yossarian () planet nl] Sent: Sunday, 2 February 2003 2:41 p.m. To: Arjen De Landgraaf; 'Steffen Dettmer'; full-disclosure () lists netsys com Subject: Re: [Full-disclosure] CERT, Full Disclosure, and Security By Obscurity Possible, NZ is digital heaven compared to some other countries. Will you make the alerting service free then? Because many posters do not like commercial or government entities running away with their work. I am not saying you will, but it just might happen - it is happening all over the place. I guess the progress in our field made over the last few years, is currently being reversed. ----- Original Message ----- From: "Arjen De Landgraaf" <arjen.de.landgraaf () cologic co nz> To: "'Steffen Dettmer'" <steffen () dett de>; <full-disclosure () lists netsys com> Sent: Saturday, February 01, 2003 11:02 PM Subject: RE: [Full-disclosure] CERT, Full Disclosure, and Security By Obscurity What about making it available through www.e-secure-db.us ? right now it is a frozen copy, last update 30 October 2002. However, that can be changed. Arjen New Zealand -----Original Message----- From: Steffen Dettmer [mailto:steffen () dett de] Sent: Sunday, 2 February 2003 10:15 a.m. To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] CERT, Full Disclosure, and Security By Obscurity * Len Rose wrote on Thu, Jan 30, 2003 at 09:22 -0500: [...]
With the recent evidence that CERT informed it's paying members about the Sapphire SQL worm before the rest of the world should now indicate that they too are not a useful resource for timely and open security
information. [...]
and the security information it hopes to provide may well become illegal (at least here in the US) To summarize my opinion, I feel that security information must simply be made available to as many people as possible as quickly as possible, and let corporations, systems staff, and security professionals handle the problems. "The public has a right to know.."
So we need a non-US OpenCERT? When the US laws make it illegal to know about incidents, I think finally incidents will need to be reported for and from non-US only, hum. Aren't the current practices here looking like steps backward? Still confused... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: CERT, Full Disclosure, and Security By Obsc urity Arjen De Landgraaf (Feb 01)
- Re: CERT, Full Disclosure, and Security By Obscurity yossarian (Feb 01)
- <Possible follow-ups>
- RE: CERT, Full Disclosure, and Security By Obsc urity Arjen De Landgraaf (Feb 01)