[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140319220641.GA5303@debjann.fritz.box>
Date: Wed, 19 Mar 2014 23:06:41 +0100
From: Jann Horn <jann@...jh.net>
To: oss-security@...ts.openwall.com
Subject: Re: [OT] FD mailing list died. Time for new one
On Wed, Mar 19, 2014 at 11:29:11PM +0400, gremlin@...mlin.ru wrote:
> On 19-Mar-2014 09:33:58 -0700, Dean Pierce wrote:
>
> > Hosting? That's what the cloud is for.
>
> Not for any sensitive data. And vulnerability descriptions are very
> sensitive...
After they've been made public intentionally?
> > I trust Google as a neutral third party more than I would trust
> > most security researchers.
>
> Bwa-ha-ha-ha-ha...
>
> Behind that party which you possibly may trust, there's a B.B.,
> which is even worse than a Big Brother - as it's a Big Business.
>
> When a Big Business faces something, it asks itself two questions:
> 0. Could it cause any loss?
> 1. Could it bring any profit?
>
> Suppose someone posts a zero-day vulnerability on the list which
> affects the BB; do you really think it wouldn't be censored out?
>
> No doubt, it will - otherwise that will Cause a Loss, and that's
> inacceptable for BB.
Have a look at the big picture. If Google censors a vuln in a google-related
service on such a list, they will get massive criticism, and for a business,
that's even worse.
A vuln in a Google service? That's a mistake. Intentional censoring by Google
in a place where they're supposed to be a neutral third party? That's evil.
And "Google made a stupid mistake" in the headlines is much better for them
than "Google did something evil". They won't do it, not just for ethical
reasons, but also because censoring is bad for their money.
> > They already host all the old newsgroup archives. It's also
> > free, easily consumable, and most importantly, babysat for
> > security issues in a way that even a team of skilled volunteers
> > would have a hard time pulling off.
>
> I'd prefer participating on the list hosted by some party which
> isn't directly affected by list postings - say, some ISP.
<sarcasm>Yeah, because we've never seen an ISP with totally crappy
reactions to vuln reports.</sarcasm>
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
