-----Original Message-----
From: Jay Libove [mailto:libove@felines.org]
I think Simple Nomad wrote an excellent analysis of the problem of a COTS
vendor (in this case, Sybase) "requesting" (make legal threats) against a
security research firm to not disclose the details of a discovered
vulnerability.
I second your conclusion to Simple Nomad's analysis. I unfortunately have
had and continue to have the same experience with vendors. Some that are
vendors of security products and I honestly expected to be positive. </naïve>
To that end, I have encouraged my employer to perform some commercial
activism by contacting the commercial product vendor, as a concerned
customer, and suggesting that we disapprove of their policy of using legal
threats to keep the vulnerability details quiet. I have further suggested
that we should copy such notice to our lobbyists / elected representatives.
Excellent. If everyone on these lists that is a licensed/paying user of Sybase
products contacted Sybase to express their concern and displeasure, their
stance would quickly change. Let them know you'll vote with your dollars.
Anyone remember when someone published Carly the HP CEO's email address
to a certain list and the 1,000's of emails she got over the Snosoft lawsuit?
(I think it was Snosoft, wasn't it?)
HP changed their tune really fast and claimed "it was all a misunderstanding".
How about a little noise from the community. NGS should drop a name or an
email address if they find they cannot make progress on this.
Also, where are the clueless media articles about this? Where are the media
folks for that matter? I know you guys are reading BT.
Stop writing about Microsoft-funded studies analyzing Linux security
and write about some real information.
Arian Evans
Sr. Security Engineer
FishNet Security
Phone: 816.421.6611
Toll Free: 888.732.9406
Fax: 816.421.6677
http://www.fishnetsecurity.com
The information transmitted in this e-mail is intended only for the addressee
and may contain confidential and/or privileged material.
Any interception, review, retransmission, dissemination, or other use of, or
taking of any action upon this information by persons or entities
other than the intended recipient is prohibited by law and may subject them to
criminal or civil liability. If you received this communication
in error, please contact us immediately at 816.421.6611, and delete the
communication from any computer or network system.
