[WEB SECURITY] RE: [Full-disclosure] Re: [WEB SECURITY] Cross Site Scripting in Google

Martin O'Neal martin.oneal at corsaire.com
Thu Jul 6 07:34:50 EDT 2006


> my opinion is that full disclosure is not for vendors .. 
> it's for users. full disclosure is for us to know how to 
> react on certain threads. 

Which is just fine if you are technically competent to understand the
threat, and there is also a valid mitigating strategy you can employ
immediately.  For the vast majority of situations though, this just
isn't the case.  The users are not technically competent enough to
understand the true threat posed by an entry on a news group (which are
generally hopelessly incomplete and/or factually inaccurate) and then
this is coupled with a vulnerable product that may be essential,
difficult to protect, and a stable official fix that may be weeks or
months away from delivery.

I personally also believe in full disclosure, but it has to be delivered
in a responsible fashion.  Dispatching vulnerabilities to a public list
without even attempting to contact the vendor is clearly not in the best
interest of the vendors nor the great majority of the user base.

Martin...


----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]



More information about the websecurity mailing list