Re: NSP-SEC

[Gadi Evron <ge () linuxbox org>]

On 3/20/10 8:37 PM, William Pitcock wrote:
> That is not what I mean and you know it.

What do you mean than? Hank made a good point on the type of traffic 
normally going through these groups.

> What I mean is: why can't anyone contribute valuable information to the
> security community?  It is next to impossible to meet so-called 'trusted
> people' if you're new to the game, which is counter-productive.

Well, that's not transparency at all. That's about being able to get 
connected, and be trusted. That's called a process.

Now, I've been preaching public engagement for years now, and indeed 
also made several attempts in this regard -- some very successful, 
others failed miserably.

There are three suggestions I can make:
1. Join the open mailing lists and show your usefulness. Places where a 
lot of us hang out (depending on communities): NANOG, funsec.

2. Show you are responsive and responsible in handling issues in your 
own back yard.

3. Go to conferences and drink beer with people.

> If you're a 15 year old kid and you just discovered a way to own the
> latest IOS, for example, how do you know who to tell about it?

That's a completely different question yet again, on vulnerability 
disclosure. In this particular case, try Cisco PSIRT.

I recently wrote a post on how to handle the PR aspects of vulnerability 
disclosure, but it covers the basics in the first few paragraphs and I 
think it will clear the subject for you.
http://www.darkreading.com/blog/archives/2009/12/security_pr_str.html

        Gadi.


> William


--
Gadi Evron,
ge () linuxbox org.

Blog: http://gevron.livejournal.com/