Seems someone missunderstand how it's dangerous to kill bu g report information which SHOULD be posted to bugtraq. There's only two ways:

1) If OS/software errors is posted to bugtraq, the software/OS patch comes quickly and people can avoid to get their systems compromised by hackers(do not mix it with thieves or smth!)/warez pirates/skript kiddies/blackhats/viruses(like nimda,klez,apache worm) and so on.

2) If error reports will be killed and the law will not permit to force vendors fix their software(ALL software are always full of programming errors because vendors sells it before they fix own mistakes) this information will not be stopped spreading (like warez was and are always some sort like this) and vendors will get buq reports too late - when too many systems will get compromised.

So, it's your choice to protect people from vendor's mistakes or ignore it and release the laws which will not help to protect it.

Thanks for reading this and maybe politics will find way to release law wich will protect people from vendors mistakes(Like mistakes which was made by Microsoft - the IIS unicode problem, the IE/Outlook incorrect MINE headers exploit which Klez/Nimda/Sircam viruses use and so on)...

By the way, there's no law which will not allow to describe this sort information in my country Lithuania..;)



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/100/16131#16131