One other point here[once again my opinion], While many licenses forbid reverse engineering etc, if you're license becomes void for researching security vulnerabilities or disclosing them to the public then you need to point out to whomever makes budgeting decisions that this is not the product to use. Simply because their uncooperative attitude will end up costing *your* business money cleaning up a hacker attack if you follow the license! And for a business, that's all that matters[imho]. (I would seriously have you or your boss compare an IT cleanup of your servers after compromise to the cost of integrating a new product into your production environment over the long term), the product may be good but if you and other businesses are going to be screwed over by an environment of immaturity, is it worth it? once again my two cents, nick ----- Original Message ----- From: "Florian Weimer" <Weimerat_private-Stuttgart.DE> To: "Josha Bronson" <dmuzat_private> Cc: <vuln-devat_private> Sent: Thursday, January 17, 2002 05:04 Subject: Re: Complicated Disclosure Scenario > Josha Bronson <dmuzat_private> writes: > > > So, what would you do? > > Write to the vendor and announce the publication of the preliminary > results within, say, two weeks, and rely on Full Disclosure forcing > the vendor to provide a fix. (However, there might be constraints in > your license contracts which could make this illegal.) > > I'm surprised that this aspect of Full Disclosure is still necessary > today. > > -- > Florian Weimer Weimerat_private-Stuttgart.DE > University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/ > RUS-CERT +49-711-685-5973/fax +49-711-685-5898
This archive was generated by hypermail 2b30 : Thu Jan 17 2002 - 13:12:27 PST