Full Disclosure mailing list archives
Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more...
From: James Tucker <jftucker () gmail com>
Date: Sun, 13 Mar 2005 13:13:39 +0000
This is a long thread consisting of a wonderful amount of dis-information. You're all doing the US intelligence services a massive favour, well done. Frankly, there is no evidence to suggest that any of you 'know' anything real about the exchange of information between governments and Microsoft. If you don't know, why are you speaking? Some facts to add to the fray: - Microsoft source code is available in certain organisations outside of Microsoft. - Given source code, patches for exploits / workarounds can be developed locally in good time. - If there is no (releasable) patch ready, there is no good reason to inform the world of the existence of an exploit, unless some particular notes about defense are included. - Deception is one of the most important parts of preemptive national infrastructure protection, deception leads to mis- and dis-information meaning even some of those who make the decisions don't really know the whole story. - Critical infrastructures in well planned government organisations are almost un-identifiable. Now some food for thought: - Does the US Government (one of the most hated in the world) operate on US soil? Would that be a good or a bad idea in terms of security? And what about in terms of deception? Do you know the answer? Could you ever _know_ the answer? - Does the govm't need MS to send them any information? Do they ask for it anyway to 'keep up appearances'? - Lawful requirements. It can be construed that any citizen should be under lawful duty to inform the relevant authorities of all dangers which may have been created, controlled or observed by that citizen wherever there may be a potential danger to any major infrastructure. I don't see where this thread is going, or really where it could go. You can mail Microsoft's already busy security group if you want, but mass mailing isn't a good solution, didn't you learn from your experiences of bullying that such actions never work, especially against the giants. You have to make them see the error of their ways, and this requires a consistent argument. The MVP program should be the target of this argument, along with politicians. I entrust infrastructure security to the professionals whom are employed for that task. I trust in my government to employ the right people, and to take the necessary actions to try and ensure my safety. They may have flaws or holes in places, but it is for that reason I do not attempt to suppress them. Clearly there is a massive lack of trust of the US government, this seems particularly strange in a country which claims to be the leader of democracy. If an exploit is leaked as a result of pre-announcement information exchange between the US government and MS, then it is leaked that is all. It is a more important fact that there exists some path for information flow, than the information itself Once leaked please remember that this is only as bad as the person receiving the leak "discovering" it. In any case, if no patch is yet available, there is nothing which can be done to prevent the exploit (barring workarounds). This is the potential time for dangerous disclosure, as is evident from the full-disclosure policy. The race is on between the patching team and the exploit coder. Critical infrastructure needs to be safe during this time but how critical, maybe like government critical? What classifies critical infrastructure, well Vladis had it mostly right, but please don't forget to add that anything holding critical information can also be critical infrastructure. This can include simple things such as a revealing letter or a simple user password. There are many ways to exploit the real world, and attacks of governments don't tend to be limited to virtual or logical structures. Your $0.02, as I dont deal in $. :-) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://www.secunia.com/
Current thread:
- RE: Reuters: Microsoft to give holes info to UncleSam first - responsible vendor notification may not be a good idea anymore..., (continued)
- RE: Reuters: Microsoft to give holes info to UncleSam first - responsible vendor notification may not be a good idea anymore... joe (Mar 12)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... Raj Mathur (Mar 12)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... Anders Langworthy (Mar 15)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... Niek (Mar 12)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... Scott Edwards (Mar 13)
- Re[2]: Reuters: Microsoft to give holes info to UncleSam first - responsible vendor notification may not be a goodidea any more... phased (Mar 13)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... James Tucker (Mar 13)
- Re: Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more... Vincent van Scherpenseel (Mar 13)