Full Disclosure mailing list archives
Re: HP Full Disclosure Story
From: full-disclosure () lists netsys com (Georgi Guninski)
Date: Sat, 24 Aug 2002 17:56:22 +0300
Just take a look at real world. When you buy a beer or a car and then find a bug in it, you may disclose the bug as you wish. (As bonus, both beer and cars come with warranties, unlike warez). So what makes beer and cars so different than warez? Or are you suggesting that if someone gets poisoned by a single buggy beer, they keep quiet for thirty days so the beer maker fix the bug silently? Georgi Guninski http://www.guninski.com Steven M. Christey wrote:
[the main parties have been blind CC'ed to ensure their awareness, but also so they don't receive double copies of responses to this email] Georgi Guninski said:This clearly illustrates why the responsibility RFC is a really evil thing. They are using funny arguments, but consider what threats they shall make if they have a RFC at hand.I have broken down this scenario relative to the details of the Responsible Vulnerability Disclosure document. It demonstrates that both parties have deviated from that document to some extent. As many have discussed on this list and elsewhere, every disclosure scenario is different, and it has been a challenge to try and cover reasonable scenarios in the RVD document (some have said that this means we shouldn't even try to write a document because of this, but I'm not so quick to give up.) The current document does not cover everything that appears to have occurred in this case, however it does demonstrate a number of issues.
Current thread:
- HP Full Disclosure Story Tamer Sahin (Aug 23)
- HP Full Disclosure Story full-disclosure () lists netsys com (Aug 23)
- HP Full Disclosure Story KF (Aug 23)
- HP Full Disclosure Story hellNbak (Aug 23)
- HP Full Disclosure Story Georgi Guninski (Aug 23)
- <Possible follow-ups>
- HP Full Disclosure Story Steve Manzuik (Aug 23)
- Re: HP Full Disclosure Story Steven M. Christey (Aug 23)
- Re: HP Full Disclosure Story KF (Aug 23)
- Re: HP Full Disclosure Story Georgi Guninski (Aug 24)
- Re: HP Full Disclosure Story Kurt Weiske (Aug 24)
- Re: HP Full Disclosure Story Isaak Bloodlore (Aug 24)
- Re: HP Full Disclosure Story hellNbak (Aug 24)
- Re: HP Full Disclosure Story Charles Stevenson (Aug 26)
- Re: HP Full Disclosure Story KF (Aug 26)
- Re: HP Full Disclosure Story KF (Aug 26)
- Re: HP Full Disclosure Story Anthony DeRobertis (Aug 25)