My $0.02: Until corporations such as Microsoft act responsibly in identifying and fixing security holes in their products, I fully support full disclosure of product security vulnerabilities. Remember L0pht vs. Microsoft a couple of years ago? Mudge from the L0pht tried to inform MS about their weak LANMAN password encryption scheme and Microsoft repeatedly denied that it was an issue. After multiple attempts to let Microsoft know before the exploit was publicized, L0pht finally released L0phtcrack to prove their point.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/59/10538#10538