Full Disclosure mailing list archives
Fwd: fuck symantec & boycott bugtraq
From: ratel <ratel () mailvault com>
Date: Sun, 12 Jan 2003 17:51:37 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- [Full-Disclosure] Fwd: fuck symantec & boycott bugtraq O.C.Rochford O.C.Rochford" <orochford () inet-sec org
hello
that is quite frankly a lot of bollocks. fact is that you can't research everything yourself, the amount of information is just too great, all this does is remove a place where peoples own research can be speeded up without having to reinvent the wheel, as well as sharing the findings of research.
The community of people genuinely interested in finding exploits and sharing them with each other will adapt. The community of leeches who need everything handed to them on a silver platter--being too dimwitted/undermotivated to spend five minutes on Google--will suffer. Which is as it should be. Besides, isn't there something inherently problematic with the kind of mentality that deliberately chooses to rely on a narrow range of sites as "the definitive source" for information about a given subject? Especially something as complex and important as computer security? You should. I can assure you that anyone interested in spreading disinformation couldn't be more delighted to find a sizable chunk of people in a field so uncritically dependent on one source of information. Getting rid of single points of failure in any information dissemination system is a good thing. If this inspires more people to wake up and do more independent critical thinking on their own, where's the downside? I have a problem with the idea of lulling people into thinking their few sanitized sources will provide all the answers for them. It's a sucker's game.
If you are saying you can audit the code of a whole OS yourself, than you must be a code god, and all of these people who bitch about "sciptkiddies" and the like just stealing other people's research should only say so if they have never made use of these sources themselves.
Putting the question of my credentials and abilities aside for a minute, ask yourself: when was the last time you saw exploit code coming out of Ft. Meade(or an NSA-affiliated FFRDC)? You think they haven't written any? No amount of handwaving will ever change the fact that many talented people (for whatever reason)are motivated to keep exploits to themselves. Given that you'll always be vulnerable, where's the sense in tricking people into thinking that as long as they keep up with what's happening at SecurityFocus they'll be safe? Dropping the "full disclosure" posturing in favor of the infinitely more honest "exploits for customers" policy makes explicit what cynics have known all along. It's not about "responsible disclosure", it's about not giving away a marketable commodity for free. Fine. Now maybe it'll be a little harder to avoid owning up to who's actually been doing the work.
You have to start somewhere to learn, and you have to be able to pool resources to share the load in auditing the amount of code and programs available today.
True, but none of this will change for people genuinely interested in finding community--nobody worth mentioning is going to stop learning and sharing. It's just going to move away from SecurityFocus and potentially raise the bar a little. Which is fine with me. Ratel. *** "Americans used to roar like lions for liberty. Now we bleat like sheep for security." - Norman Vincent Peale. -----BEGIN PGP SIGNATURE----- Version: MailVault 2.2 from Laissez Faire City http://www.mailvault.com iQA/AwUAPiHxP+YNtyh3zif9EQKhrACfUQGz3IJDJjghUuOcmRWIypss62IAn3DH sVQ57Eo546N3p5FqoJCcfW+8 =7zfT -----END PGP SIGNATURE-----
Current thread:
- Re: Fwd: fuck symantec & boycott bugtraq, (continued)
- Message not available
- Re: Fwd: fuck symantec & boycott bugtraq David M. Wilson (Jan 10)
- Re: Fwd: fuck symantec & boycott bugtraq Ka (Jan 10)
- Re: Fwd: fuck symantec & boycott bugtraq Ken Dyke (Jan 10)
- Re: Fwd: fuck symantec & boycott bugtraq Ka (Jan 11)
- Re: Fwd: fuck symantec & boycott bugtraq Ken Dyke (Jan 12)
- Re: Fwd: fuck symantec & boycott bugtraq O.C.Rochford (Jan 12)
- Re: Fwd: fuck symantec & boycott bugtraq hellNbak (Jan 12)
- Re: Fwd: fuck symantec & boycott bugtraq Nicob (Jan 12)
- Re: Fwd: fuck symantec & boycott bugtraq hellNbak (Jan 12)