Security in an Open Electronic Society

Security in an Open Electronic Society
Elias Levy, SecurityFocus 2001-10-21

Microsoft's argument against 'information anarchy' is as self-serving as it is illogical.

Security in an Open Electronic Society 2001-10-22
j

I beleive that it is our duty to find exploits in code and to let the vendor know as well as our fellow white hats. There is definitly a procedure to follow, generally letting the vendor know about it first and foremost. But if they will not do anything or are not moving fast enough it is importan...

[ more ] [ reply ]

RE: Security in an Open Electronic Society 2001-10-22
fad3r

It seems like Elias has to write something like this every other month. Sadly, I dont thing any vendor is ever going to "get it". Why would they? Taking the time to correct security issues before the product is released would push back the release date. That means a loss of time and time means a...

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-22
Anonymous

As a side note, Alan Cox (of linux hacking fame) is taking this to an extreme. He will no longer post the details of the security fixes to the linux kernel in plain text.

Of course, if you can RTSL, you've got everything you need....

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-22
Anonymous

The shocking bit about this is that Mr. Culp has long been opposed to any degree of full disclosure but until recently

it was never codified in MS (public) written material. With Culp posting his diatribe you can be assured that it went through an approval process. As such this appears to be the p...

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-23
rgerber.nipc (at) fbi (dot) gov [email concealed] (1 replies)

I take your point about denying opportunities. How do we go about "neutralizing their motivations to attack?" Bob Gerber...

[ more ] [ reply ]

Motivation to attack 2001-10-26
Tigger

Motivation has become the interest of psychologists. I recently read an article (can't recall the publication at present) that was covering DefCon 9. One of the attendees was overheard saying something like "..I wonder how I can hack my ID badge.." From the article, it sounded like the badge was ...

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-23
Anonymous Security Professional

Well the issue is quite simple...Until software development organizations first accept responsibility for the software they produce, including liability and accountability for security flaws, they should not even consider attempting to regulate or even suggest control measures regarding the disclosu...

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-23
Anonymous

It seems to me that those who would try to ban the dissemination of vulnerability information are like the clerics of the renaissence who tried to suppress scientific discovery if it conflicted with their world view. Although they succeeded in silencing a few scientists, it was a lost battle, becaus...

[ more ] [ reply ]

Security in an Open Electronic Society 2001-10-25
dumbwabbit

One of my biggest peeves is that companies (prime example being Microsoft) should not blame admins so much.

If M$ could be bothered to release recompiled versions of their products that incorporate the latest fixes, new installations and implementations would be that much safer.

Imagine Microsoft ...

[ more ] [ reply ]