Date: Sat, 23 Aug 2014 21:49:03 -0500 From: ken <ken@...williams.us> To: oss-security@...ts.openwall.com Subject: Re: FYI, change to Secunia vuln db EULA I feel a need to clarify my previous email ... Secunia obviously has an extremely useful and comprehensive vulnerability database. All of their vulnerability mgmt, patch mgmt, and scanning products are excellent too. The IT industry needs high quality vuln and patch mgmt solutions like this, and Secunia needs revenue so they can maintain and improve their products/solutions, conduct research, build new products, make a profit, etc. There are some potentially adverse consequences to their decision to close their vulnerability database: 1) All direct links to Secunia vuln db entries are effectively dead ends now ... unless the link clicker is a student, press, private person, hobby/non-commercial security researcher and gets "community" (free) access, OR is a non-profit organization, private company, or public authority/entity who has paid the annual fee for the VIM product. I imagine most people reading this email fall into the latter group, do not have access, and will need to pay for access. 2) Vendors can apparently no longer review the Secunia vuln db so they can submit updates and corrections (unless the vendor has purchased the VIM product?). Will this result in Secunia vuln db info becoming less accurate and up-to-date? 3) If you maintain a public or private vulnerability database, or vulnerability website, you will no longer be able to effectively reference or cross-reference the Secunia vuln db, unless you pay for access. How will this impact OSVDB, NVD, CVE, IAVM, PacketStorm, etc? Depending on your interests in vulnerabilities and role(s) in the security industry, you may see other consequences. Bottom line for me is that I had been using the public, freely available Secunia vuln info every day for over 10 years, and I had been regularly submitting vuln info/updates/corrections. I'm currently not using it at all (in compliance with their EULA). If the VIM cost fits into my budget, then I'll definitely purchase it. Maybe this is a necessary and/or business-savvy decision for Secunia. I don't know, and it's not my place to guess or judge. I simply consider it unfortunate that a once publicly accessible and invaluable vuln db is now closed to many/most of us. Regards, Ken The opinions and statements in this email are my own and do not necessarily reflect the opinions or policies of my employer.  $28,400/year as of Feb 2013. May not fit into budget for some non-profits, govt agencies, smaller businesses. Reference: http://goo.gl/N2DikW
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ