Re: public comment period for the Draft Security Vulnerability Reporting and Responding Process (OISAFETY)

["morning_wood" <se_cur_ity () hotmail com>]

real condensed version of my ideas...


 Most real vulnerabilities and their discoveries occur the wild... obviously
some on machines not belonging to the creditor / discoverer. Often you
say... what do I do with this info? If I report it i may be arrested? If I
dont someone with evil intentions may and will.  Jurisdiction is so enormous
in scope to define any punishable offence. The world in general needs to
accecpt that internet parcipation is on a voluntary basis, and carries such
risks of a "open market". It is quite unfortunate that profits were to be
made and maintained as a business structure long before there were ANY
accecpted standards of ANYTHING. I think the best possible comparison to the
real world is that of vintage aircraft and autos. Both are generally allowed
to continue thier operation without modern safegaurds, despite the dangers
of operating them in and around thier more modern counterparts. Given log
data to a court or jury of  two breakin / attack / compromise scenarios,
both orriginating from the same physical locale, can be very different
depending on techniques used, but yet one is punishable by the evidence and
one is not, although both were exactly the same.. this does not do for a
real world jail sentence.
 Until these issues are either accecpted or resolved... you  cannot have
punishible internet laws. If  internet crime manefests itself into a
physical crime or a crime where a person or companys assests were physically
transfered and recieved and / or  are of an officaly established
international monetary systems and infrastructure, then it is handled
acordingly . Crimes of this nature are already provided for in all major
countries as it is, as they have always been punishible since nearly the
time they have existed. Untill I can physically implode your CRT in your
face or  pop open a cdtray with  hot coffee in front of it and it spills and
burns you, I cannot see how there can be any definable standard  for
punishible electronic crime at all.

Donnie Werner
http://exploitlabs.com
se_cur_ity () hotmail com


----- Original Message -----
From: "Cesar" <cesarc56 () yahoo com>
To: <full-disclosure () lists netsys com>
Sent: Wednesday, June 04, 2003 1:20 PM
Subject: Re: [Full-disclosure] public comment period for the Draft Security
Vulnerability Reporting and Responding Process (OISAFETY)


> Sorry, but it sucks.
>
> They forgot to add:
>
> Section 10.1
> If the finder doesn't follow this, he will be
> prosecuted and nobody in the security community will
> like him.
>
>
> Anyone with me?
>
> Cesar.
> --- Craig Ozancin <cozancin () symantec com> wrote:
> > The Organization for Internet Safety is pleased to
> > announce the
> > beginning of the public comment period for the Draft
> > Security
> > Vulnerability Reporting and Responding Process.
> > This draft process is
> > the result of a lengthy collaboration between
> > leading security
> > researchers and  software vendors.  We have worked
> > hard to develop a
> > process that addresses the needs of both security
> > researchers and
> > software vendors, and provides a framework for
> > achieving our shared
> > objective of improving security for computer users,
> > the Internet, and
> > the critical infrastructures that depend on it.  We
> > welcome your
> > comments on the draft. Please read the draft and
> > find instructions on
> > submitting comments at http://www.oisafety.org/.
> >
> > The period for comments will close on 7 July, 2003.
> > The final process
> > document will be released at the Black Hat Briefings
> > (www.blackhat.com)
> > in Las Vegas from 28-30 July, 2003.
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter:
> http://lists.netsys.com/full-disclosure-charter.html
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
> http://calendar.yahoo.com
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html