Full Disclosure mailing list archives
Re: CERT, Full Disclosure, and Security By Obscurity
From: "yossarian" <yossarian () planet nl>
Date: Sun, 2 Feb 2003 02:40:54 +0100
Possible, NZ is digital heaven compared to some other countries. Will you make the alerting service free then? Because many posters do not like commercial or government entities running away with their work. I am not saying you will, but it just might happen - it is happening all over the place. I guess the progress in our field made over the last few years, is currently being reversed. ----- Original Message ----- From: "Arjen De Landgraaf" <arjen.de.landgraaf () cologic co nz> To: "'Steffen Dettmer'" <steffen () dett de>; <full-disclosure () lists netsys com> Sent: Saturday, February 01, 2003 11:02 PM Subject: RE: [Full-disclosure] CERT, Full Disclosure, and Security By Obscurity What about making it available through www.e-secure-db.us ? right now it is a frozen copy, last update 30 October 2002. However, that can be changed. Arjen New Zealand -----Original Message----- From: Steffen Dettmer [mailto:steffen () dett de] Sent: Sunday, 2 February 2003 10:15 a.m. To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] CERT, Full Disclosure, and Security By Obscurity * Len Rose wrote on Thu, Jan 30, 2003 at 09:22 -0500: [...]
With the recent evidence that CERT informed it's paying members about the Sapphire SQL worm before the rest of the world should now indicate that they too are not a useful resource for timely and open security
information. [...]
and the security information it hopes to provide may well become illegal (at least here in the US) To summarize my opinion, I feel that security information must simply be made available to as many people as possible as quickly as possible, and let corporations, systems staff, and security professionals handle the problems. "The public has a right to know.."
So we need a non-US OpenCERT? When the US laws make it illegal to know about incidents, I think finally incidents will need to be reported for and from non-US only, hum. Aren't the current practices here looking like steps backward? Still confused... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: CERT, Full Disclosure, and Security By Obsc urity Arjen De Landgraaf (Feb 01)
- Re: CERT, Full Disclosure, and Security By Obscurity yossarian (Feb 01)
- <Possible follow-ups>
- RE: CERT, Full Disclosure, and Security By Obsc urity Arjen De Landgraaf (Feb 01)