Full Disclosure mailing list archives
Re: Rate Stratfor's Incident Response
From: Paul Schmehl <pschmehl_lists () tx rr com>
Date: Fri, 13 Jan 2012 13:24:49 -0600
--On January 13, 2012 12:03:22 PM -0500 Benjamin Kreuter <ben.kreuter () gmail com> wrote:
On Fri, 13 Jan 2012 10:37:31 -0600 Paul Schmehl <pschmehl_lists () tx rr com> wrote:--On January 12, 2012 3:16:19 PM -0500 Benjamin Kreuter <ben.kreuter () gmail com> wrote:The law is not going to stop the really bad people from attacking your system, nor is it going to stop them from profiting from whatever access they gain; sending law enforcement after someone who reports problems to you accomplishes little and only discourages people who might try to help you.Assuming everyone's motives are as pure as the driven snow is a bit naive, don't you think?Are there lingering doubts about the motives of someone who is reporting a vulnerability to you? They could have just profited from their discovery and never bothered to tell you. In any case, what have you accomplished by sending the cops after *someone who is helping you*?
Unless you're a complete fool, yes. You say you're helping me, but you broke in to my server. How do I know you didn't help yourself to a permanent back door? Again, it's naive to think that most people are motivated purely by a desire to help others, especially when they are actively intruding into other people's assets. YOU might say thank you, but I'll be taking the server offline, grabbing forensic images and rebuilding it long before I get around to saying thank you. -- Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson "There are some ideas so wrong that only a very intelligent person could believe in them." George Orwell _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Rate Stratfor's Incident Response, (continued)
- Re: Rate Stratfor's Incident Response Thor (Hammer of God) (Jan 12)
- Re: Rate Stratfor's Incident Response Valdis . Kletnieks (Jan 13)
- Re: Rate Stratfor's Incident Response Benjamin Kreuter (Jan 13)
- Re: Rate Stratfor's Incident Response Ferenc Kovacs (Jan 13)
- Re: Rate Stratfor's Incident Response Giles Coochey (Jan 13)
- Re: Rate Stratfor's Incident Response Benjamin Kreuter (Jan 13)
- Re: Rate Stratfor's Incident Response Paul Schmehl (Jan 13)
- Re: Rate Stratfor's Incident Response J. von Balzac (Jan 13)
- Re: Rate Stratfor's Incident Response Michael Schmidt (Jan 13)
- Re: Rate Stratfor's Incident Response Benjamin Kreuter (Jan 13)
- Re: Rate Stratfor's Incident Response Paul Schmehl (Jan 13)
- Re: Rate Stratfor's Incident Response Laurelai (Jan 13)
- Re: Rate Stratfor's Incident Response Gage Bystrom (Jan 13)
- Re: Rate Stratfor's Incident Response Valdis . Kletnieks (Jan 14)
- Re: Rate Stratfor's Incident Response Sanguinarious Rose (Jan 14)
- Re: Rate Stratfor's Incident Response Paul Schmehl (Jan 14)
- Re: Rate Stratfor's Incident Response Benjamin Kreuter (Jan 14)
- Re: Rate Stratfor's Incident Response Sanguinarious Rose (Jan 14)
- Re: Rate Stratfor's Incident Response Ferenc Kovacs (Jan 14)
- Re: Rate Stratfor's Incident Response Sanguinarious Rose (Jan 14)
- Re: Rate Stratfor's Incident Response Benjamin Kreuter (Jan 14)