Re: 0day Vulnerability in VLC (this is my first release of the vuln anywhere)

[dawg <mlyodawg () gmail com>]

Please remember that the title of the list is "full disclosure" not
"responsible disclosure". This is not a corporate list and nobody have
to act responsible if they don't want so. They are old enough to judge
what they do.

Some people are in the security field just for the fun part, that's not
their job. Contacting a vendor, collaborating with him, and waiting X
years for a appropriate patch is not that fun ;)

If the vendor is concerned about the security, he will see the mail sent
to this list and will act upon it.

>         > Nobody should release their disclosure/exploit (or give hint
>         about it) in
>         > the wild before letting the vendor fix it.

You should already be happy because they decided to release it and not
to keep it for them ;)

> I look forward to see who wins in this argument over personal opinion.
>
>
> On Tue, Apr 23, 2013 at 4:12 PM, Gregory Boddin <gregory () siwhine net
> <mailto:gregory () siwhine net>> wrote:
>
>     You have to think about end-users as well ... Those are impacted
>     first, not the vendors.
>
>
>
>
>
>     On 23 April 2013 16:51, Georgi Guninski <guninski () guninski com
>     <mailto:guninski () guninski com>> wrote:
>
>         Completely disagree.
>
>         IMHO nobody should bother negotiating with terrorist vendors.
>
>         Q: What responsibility vendors have?
>         A: Zero. Check their disclaimers.
>
>
>         On Tue, Apr 23, 2013 at 04:14:53PM +0200, Gregory Boddin wrote:
>         > That's indeed not rocket science.
>         >
>         > Nobody should release their disclosure/exploit (or give hint
>         about it) in
>         > the wild before letting the vendor fix it.
>         >
>         > There's already enough blackhats out there selling/using those.
>         >
>         > I sure hope I am not the only person in the list who wishes
>         responsible
>         > > disclosure.
>         > >
>         > > ---
>         > > Henri Salo
>         > >
>         > > -----BEGIN PGP SIGNATURE-----
>         > > Version: GnuPG v1.4.10 (GNU/Linux)
>         > >
>         > > iEYEARECAAYFAlF2eWAACgkQXf6hBi6kbk8p+QCgkrzZnNpipCMC/kexFq8OR3Q2
>         > > NiIAnRMYicxFqmJhvjLIEZolEKjQcEEE
>         > > =q78V
>         > > -----END PGP SIGNATURE-----
>         > >
>         > > _______________________________________________
>         > > Full-Disclosure - We believe in it.
>         > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>         > > Hosted and sponsored by Secunia - http://secunia.com/
>         > >
>
>
>
>     _______________________________________________
>     Full-Disclosure - We believe in it.
>     Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>     Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/