3 ms·
These sorts of reactions by vendors really imply to me that the full disclosure philosophy is better. How much better would things be if Symantec had kept - or
by pnathan 15y ago
These sorts of reactions by vendors really imply to me that the full disclosure philosophy is better. How much better would things be if Symantec had kept - or been kept - on the ball?
- un1xl0ser 15y agoThe philosophy of responsible disclosure is something only pushed by security vendors, people who use open-source software (it's being a good member of a community) and brainwashed white-hats. The security professionals who do this for a living, and study this should disclose fully, but a corporate entity will never. They cannot because of shareholders, and there are way to many bugs out there and it would be embarrassing cleaning up that much crap. Security vulnerabilities are sometimes architectural problems, some are related to ignorance, but a LOT more are just stupid bugs and people not writing code that is correct. A good attacker doesn't care how they get in, there is always a way. It's a losing battle, just ask EWD. http://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.html http://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.... \\ Edit: Words are tough.
- burgerbrain 15y agoThe point of full disclosure is to give the "corporate entities" that like to sit on vulnerabilities a swift kick in the ass and get them to do something...
- un1xl0ser 15y agoI plead no contest to PWI. I swear that it was all straight in my head.
- burgerbrain 15y agoNo worries, happens to the best of us. ;)
- redthrowaway 15y agoYou blew over .08; I'm rescinding your Internet license. You can apply to the MPAA to get it back in three months.