Re: [Secure Network Operations, Inc.] Full Disclosure Conclusion?

["yossarian" <yossarian () planet nl>]

> What I have understood by reading these mails is that for an individual
> to post full disclosure advisories (including exploit code) is good.
> This helps the internet community to validate patches and their all out
> security. So, for an individual, this is very good.

Well, sometimes. Some companies give you a free license to the new version
if you don't disclose. That is good too, if you are the kind of individual
normally paying for software. Better still, some companies ask you to think
with them about new features. But I guess that individuals posting sploits
for the benefit of the Internet are a rare lifeform.

> For a security company to release full disclosure advisories however
> might be an issue for the company. A company might want to consider
> releasing the information to the vendors only.  And the vendor should
> release a patch.

For security companies it is a marketing strategy: a way of saying look at
me, i am good. Look at X-Force, they did a lot of research promoting ISS,
look at KPMG that started posting vulns on bugtraq - no i am not kidding.
That the security of certain products improve is a by-product. And the
probability is, that new version will have new issues.

> Problem is, the pressure from making an issue known is often what gets
> the issue fixed.  So with that said, there should be a different way for
> companies to leverage vendors into producing patches without disclosing
> the full exploit and without causing damage to the industry and to
> prospective clients. That is, only if the company will be politically
> damaged by releasing full exploit code.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html