Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Jul 2015 12:37:29 -0500
From: Brandon Perry <bperry.volatile@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Cc: Qualys Security Advisory <qsa@...lys.com>
Subject: Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser

Prefer the term coordinated disclosure.

Sent from a phone

> On Jul 24, 2015, at 10:56 AM, mancha <mancha1@...o.com> wrote:
> 
>> On Thu, Jul 23, 2015 at 08:43:43PM +0200, Leif Nixon wrote:
>> Qualys Security Advisory <qsa@...lys.com> writes:
>> 
>>> Hello, it is July 23, 2015, 17:00 UTC, the Coordinated Release Date
>>> for CVE-2015-3245 and CVE-2015-3246.  Please find our advisory
>>> below, and our exploit attached.
>> 
>> *Why* are you releasing a full exploit just minutes after the patch is
>> released?
>> 
>> (Disclosure: I am employed by Red Hat, but this is my purely personal
>> question.)
>> 
>> -- Leif Nixon
> 
> There was absolutely nothing wrong with Qualys' timing. When the embargo
> ends, it ends.  
> 
> The real problem is the underlying model: "responsible disclosure". It's
> nothing more than a CYA strategy that doesn't maximize the ecosystem's
> welfare. The positive-sounding name fools some into thinking it a good
> thing.
> 
> --mancha

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ