Full Disclosure mailing list archives
Re: Exploit release
From: "J.A. Terranson" <measl () mfn org>
Date: Sun, 4 Apr 2004 19:05:28 -0500 (CDT)
On Sun, 4 Apr 2004, Martin Bealby wrote:
I was thinking about the process of exploit release recently, due to the case of the Frenchman publishing his finding of research into those steganography programs, when I came upon a strange thought. If I find an exploit, and publish it straight away, I could annoy a (possibly large) number of users, and the software developers. Although I don't see how I could sensibly be attacked legally. However, if I find an exploit, notify developers, wait a certain time period (also told to the developers), and the developers have not and will not fix it, what can I do? If I publish anyway, wouldn't I be open to possible blackmail charges? Which option would be best to follow? Personally, I think it's a difficult choice. Option one seems to cover your own back but could lead to a large number of exploited machines, while option two should (theoretically) lead to fewer exploited machines (due to software updates), but could turn nasty. If I was faced with this situation, I'm not sure what I would do. Cheers, Martin
2 on the Troll-O-Meter. Thanks for playing though. -- "One of the nice things about ignorance is that it is curable. Unlike Neo-Conservatism. Eric Michael Cordian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Exploit release Martin Bealby (Apr 04)
- Re: Exploit release J.A. Terranson (Apr 04)
- Re: Exploit release Martin Bealby (Apr 05)
- Security / Privacy regulations USA/EU/AU n30 (Apr 06)
- Re: Security / Privacy regulations USA/EU/AU Paul Schmehl (Apr 06)
- Re: Exploit release J.A. Terranson (Apr 04)