Actually, this is overly simplistic. Especially when we are
dealing with home users, immediate disclosure to the public is
irresponsible.
My parents are not subscribed to this or any other security
bulletin mailing list, for example, and even though I try to keep them
as up to date as possible, the chances that they are going to be able to
update their system immediately is pretty slim unless we're talking
about a patch distributed via AU. The implication that they chose not to
heed the warning is ludicrous.
But even in the case of a business, assuming that everyone can
just apply every patch that comes down the pipe blindly and hope for the
best is unreasonable.
Like Drew, I believe in Full Disclosure. But are you really
telling me that it is reasonable to give the vendor time to test a
patch, but not the end users?
-----Original Message-----
From: Windows NTBugtraq Mailing List
[mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM] On Behalf Of Jason Coombs PivX
Solutions
Sent: Thursday, October 07, 2004 5:00 PM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Re: [Full-Disclosure] RE: Disclosure policy in Re: RealPlayer
vulnerabilities
Drew Copley wrote:
... ... ... ... ... ..., and, ... ... ...
Drew,
<snip>
To disclose, or not to disclose. That is the question.
<snip>
Immediate full disclosure that cannot be disputed and leaves no room for
debate immediately helps anyone who chooses to receive and consider the
disclosure. Everything else serves only to delay and obscure that clear
and urgent security alert communique, increasing the window of exposure
and the Total Risk of Ownership needlessly.
<snip>
--
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such
that just hitting reply is going to result in the message coming to the list,
not to the individual who sent the message. This was done to help reduce the
number of Out of Office messages posters received. So if you want to send a
reply just to the poster, you'll have to copy their email address out of the
message and place it in your TO: field.
--
