4 ms·
MSRC: Microsoft-Spurned Researcher Collective releases 0-day
- TallGuyShort 16y agoI've never heard of this before, so forgive me if I'm restating the obvious, but this appears to be getting in the face of Microsoft's MSRC: http://www.microsoft.com/security/msrc/ http://www.microsoft.com/security/msrc/ (Microsoft Security Response Center). edit: Does anyone know more about the hostility they're referring to and what their objectives are? Presumably Microsoft was being less-than-cooperative?
- fname 16y agoDoes anyone know more about the hostility they're referring to and what their objectives are? Presumably Microsoft was being less-than-cooperative? Yes, the posting refers to Tavis Ormandy, a Google security researcher, who released his advisory after 5 days of initial communication with Microsoft. The story is he wasn't happy with the timetable that Microsoft would resovle the issue in. The story got bigger as it seemed to pit Google vs. Microsoft. more: http://news.ycombinator.com/item?id=1421980 http://news.ycombinator.com/item?id=1421980
- btilly 16y agoThe later discussion at http://news.ycombinator.com/item?id=1434461 http://news.ycombinator.com/item?id=1434461 has even more information, including the following quote from taviso's twitter: I'm getting pretty tired of all the "5 days" hate mail. Those five days were spent trying to negotiate a fix within 60 days.
- kvs 16y agoThe bigger picture is vendors can't impose rules on what security researchers do on their free-time if they are not willing to pay for the bugs the researchers find and report. Hence the reference to the registry entry: "HKCU\Microsoft\Windows\CurrentVersion\Security and changing the "OurJob" boolean value to FALSE." Look up "no more free bugs" for more info. (Edit: A URL http://trailofbits.com/2009/03/22/no-more-free-bugs/ http://trailofbits.com/2009/03/22/no-more-free-bugs/)