This isn't the whitehat lovers group, anything and everything goes for
Full Disclosure.
"Just who does he think he is? [...] Zalewski may think
he's some sort of hero disclosing this information, but his is the act of a
vandal.
No a vandal wouldn't disclose the information, a vandal on the other
hand would sell the information / code to spyware companies. Hmm,
think about it.
The funny part about this whole situation is that the people that
bashed on MZ never contributed a pea to what he has to this list.
/str0ke
On 4/27/06, Pedro Hugo <fractalg@highspeedweb.net> wrote:
"Just who does he think he is? [...] Zalewski may think he's some sort
of hero disclosing this information, but his is the act of a vandal.
If
it turns out that the bug is exploitable and abused before it's
patched,
then perhaps he'll be proud to be remembered for that."
He is what he wants to be... Afaik, there are no laws about disclosure.
Everyone does what he thinks it's best, even if it's best only for himself
(like Adam Smith "said", everyone acts on their own interest).
The bug requires user interaction. If most users are too stupid to click
anything, the problem will not be solved with patching.
And, even with patches, can you estimate what percentage of systems which
are patched right away ? Yeah, most aren't!
No sysadmin likes to be catched by surprise with security problems. But,
life isn't always perfect !
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
