[Secure Network Operations, Inc.] Full Disclosure Conclusion?

[ATD <simon () snosoft com>]

So in Conclusion:

        What I have understood by reading these mails is that for an individual
to post full disclosure advisories (including exploit code) is good. 
This helps the internet community to validate patches and their all out
security. So, for an individual, this is very good.

        For a security company to release full disclosure advisories however
might be an issue for the company. A company might want to consider
releasing the information to the vendors only.  And the vendor should
release a patch.

        Problem is, the pressure from making an issue known is often what gets
the issue fixed.  So with that said, there should be a different way for
companies to leverage vendors into producing patches without disclosing
the full exploit and without causing damage to the industry and to
prospective clients. That is, only if the company will be politically
damaged by releasing full exploit code. 

Is that accurate?  



On Wed, 2003-01-29 at 17:32, Richard M. Smith wrote:
> Today, it's a decision made by the security researcher and the company
> they work for who gets what exploit code.  Down the road, my expectation
> is that the question will be addressed in courts via civil lawsuits.  
>
> Richard
>
> -----Original Message-----
> From: Day Jay [mailto:d4yj4y () yahoo com] 
> Sent: Wednesday, January 29, 2003 5:16 PM
> To: Richard M. Smith
> Cc: full-disclosure () lists netsys com
> Subject: RE: [Full-disclosure] [Secure Network Operations, Inc.] Full
> Disclosure != Exploit Release
>
>
> And what makes you think that you and your friends who
> share your dozen exploits are the right hands? What
> because you have the skill to write them, you are the
> right hands?
>
> Who decides who can have what?
>
> That's what I thought.
>
> > OTOH we know that public proof-of-concept examples
> > are going to get into
> > the wrong hands.
> >
> > Richard
>
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
-- 
ATD <simon () snosoft com>
Secure Network Operations, Inc.

Attachment: signature.asc
Description: This is a digitally signed message part