Bugtraq mailing list archives
RE: Vulnerabilities in some SCADA server softwares
From: Jim Harrison <Jim () isatools org>
Date: Wed, 23 Mar 2011 14:43:38 +0000
Michal, First; while I agree with your statement regarding the overuse of car analogies, the comparison is accurate and fair in this case. The vendor's customers are now potentially at greater risk because of this announcement that includes no mitigation. Second; I fundamentally disagree with the idea that public disclosure as a means of vendor notification serves any purpose beyond tooting one's own horn and causing a panic state for the application vendor and users. Anyone who honestly believes that the "bad guys" are not watching the same lists where the "good guys" are communicating is operating far too close to a famous Egyptian river. IMHO, "public disclosure" only serves to increase the threat for the vendor's customers. Third; it is in lists exactly like this on where opinions on security matters and behaviors may be aired (to a degree; that's what moderators and common sense are for). While it's true that a person will act as he sees fit, you may also reasonably expect that differing opinions on that behavior will be expressed when the opinions are as polarized as in the responsible vs. public disclosure debate. HTH, Jim -----Original Message----- From: Michal Zalewski [mailto:lcamtuf () coredump cx] Sent: Tuesday, March 22, 2011 2:24 PM To: J. Oquendo Cc: Luigi Auriemma; bugtraq () securityfocus com Subject: Re: Vulnerabilities in some SCADA server softwares
Analogy: Car owner has his car speed up ending up in almost near catastrophe. Car owner goes to media outlets condemning the manufacturer: "How could you be so reckless! Thousand of lives..." Reality: Car manufacturer was never made aware of the issue. How do you propose a manufacturer fix an issue?
Yes, the discussion definitely needed a car analogy... The author decided to follow a particular route, probably not out of malice, but because he believes that his responsibilities to inform the public outweigh the responsibility to assist the vendor. You wouldn't do the same, but you haven't discovered these bugs. Unless your view is that you would rather not know about about security problems at all, than see a disclosure mode you do not agree with, I do not think it's fair to lash out against the reporter; and it's not particularly fitting to do so on BUGTRAQ. /mz
Current thread:
- Vulnerabilities in some SCADA server softwares Luigi Auriemma (Mar 21)
- Re: Vulnerabilities in some SCADA server softwares J. Oquendo (Mar 22)
- Re: Vulnerabilities in some SCADA server softwares Luigi Auriemma (Mar 22)
- Re: Vulnerabilities in some SCADA server softwares Michal Zalewski (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares R Michael Williams (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares Michal Zalewski (Mar 23)
- RE: Vulnerabilities in some SCADA server softwares Jim Harrison (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares Luigi Auriemma (Mar 23)
- RE: Vulnerabilities in some SCADA server softwares Jim Harrison (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares Theo de Raadt (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares J. Oquendo (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares Simple Nomad (Mar 23)
- Message not available
- Re: Vulnerabilities in some SCADA server softwares Simple Nomad (Mar 24)
- Re: Vulnerabilities in some SCADA server softwares Kent Borg (Mar 24)
- Re: Vulnerabilities in some SCADA server softwares J. Oquendo (Mar 22)
- Re: Vulnerabilities in some SCADA server softwares Theo de Raadt (Mar 23)
- Re: Vulnerabilities in some SCADA server softwares Jamie Riden (Mar 24)
- Re: Vulnerabilities in some SCADA server softwares Willy Tarreau (Mar 25)