Text 6037, 331 rader
Skriven 2005-07-14 14:36:14 av Rich (1:379/45)
Kommentar till text 6033 av Geo (1:379/45)
Ärende: Re: eeye's irresponsible self-serving behavior
======================================================
From: "Rich" <@>
This is a multi-part message in MIME format.
------=_NextPart_000_0210_01C58881.63AC6B90
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Then I misunderstood as you started the sentence from which you =
quoted with "As for Rich's attitude about eeye being irresponsible," as = if
what followed had some relevance.
Rich
"Geo" <georger@nls.net> wrote in message news:42d6c031$2@w3.nls.net...
What I said was "to show eeye's initial stance" and I then go on to =
quote eeye. How can that not make sense to you?
Geo.
"Rich" <@> wrote in message news:42d69eb8@w3.nls.net...
Do you not see how silly this is? To support a claim that eeye =
is not irresponsible you use a statement from eeye that they are not =
irresponsible. Do you really expect them to say they are culpable?
Rich
"Geo" <georger@nls.net> wrote in message =
news:42d695b7@w3.nls.net...
No, I'm claiming that they could have taken control of almost =
every windows
computer that connects to the internet at any time since the =
"information
anarchy" program started allowing Microsoft to take 188 days to =
patch the
most critical of exploits. Prior to that their window from
discovery/publishing to patch was at most 2 weeks. But now with =
standard
patch times taking roughly half a year there is always a root =
exploit or two
that they know about that is unpatched. At the momemt there are 4 =
for
windows and several more for other very common windows programs =
and those
are just the ones eeye discovered, not the full batch of all known =
root
level exploits for windows.
As for Rich's attitude about eeye being irresponsible, this =
article about
the "information anarchy" program shows eeye's initial stance on =
things
pretty clearly.
http://www.securityfocus.com/news/281
"What's being created here is an information cartel," says Elias =
Levy,
former moderator of the Bugtraq security mailing list, a standard =
outlet for
'full disclosure' security information. "It actually benefits =
security
vendors to have limited vulnerability information, because it =
makes them
look better in the eyes of their customers," says Levy. (Levy is =
CTO of
SecurityFocus).
Under the plan, member companies would share detailed information =
during the
30-day grace period with law enforcement agencies, infrastructure =
protection
organizations, and "other communities in which enforceable =
frameworks exist
to deter onward uncontrolled distribution." The last category =
would allow
member companies to share details with clients under a =
non-disclosure
agreement, and to share details with one another. "They're not =
going to ban
it among themselves," says Levy. "They might be willing to limit =
the public
access to this information, but I highly doubt that they'll limit =
it among
each other."
Marc Maiffret, co-founder of eEye Digital Security, agrees, and =
charges that
the coalition was formed for the commercial advantage of its =
members, rather
than the well-being of the Internet.
"If it becomes hard to release vulnerabilities, that's a good way =
for
Microsoft to get rid of some embarrassment," says Maiffret.
Maiffret's company is responsible for discovering some of the most =
serious
Microsoft security holes in recent years -- vulnerabilities in the =
company's
IIS web server product that allow attackers to gain remote control =
of the
system. He says eEye cooperates with vendors, and doesn't release =
advisories
until a company has had a chance to produce patches for the =
security hole.
But Maiffret rejects the idea of holding back on technical =
details, and
warns that the new coalition may alienate independent security =
researchers.
"People have to do it Microsoft's way or they'll have this group =
telling
them that they're acting irresponsibly," says Maiffret. "It's =
going to drive
people into the underground, and could lead to more people =
breaking into
computers."
Geo.
"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in =
message
news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com...
> "Rich" <@> wrote in message news:<42d5ef53@w3.nls.net>:
> > You made a claim that 95% of computers are vulnerable to the =
point that
eeye could own them.
>
> I thought Geo's claim was that if eeye had not been publishing =
the bugs
> they had found (and just kept them to themselves) over the last =
couple of
> years, then eeye could have owned 95% of the Windows computers =
connected
> to the Internet now.
>
> Assuming that no one filled this hypothetical vacuum left by =
eeye saying
> nothing, Geo's claim looks very credible to me (with pointless =
argument
> about whether it's really 95% or 85% etc).
>
> John
>
------=_NextPart_000_0210_01C58881.63AC6B90
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2668" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2> Then I misunderstood as =
you started=20
the sentence from which you quoted with "<FONT face=3D"Times New Roman" =
size=3D3>As=20
for Rich's attitude about eeye being irresponsible,</FONT>" as if what =
followed=20
had some relevance.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote=20
in message <A=20
=
href=3D"news:42d6c031$2@w3.nls.net">news:42d6c031$2@w3.nls.net</A>...</DI=
V>
<DIV><FONT face=3DArial size=3D2>What I said was "to show eeye's =
initial stance"=20
and I then go on to quote eeye. How can that not make sense to=20
you?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d69eb8@w3.nls.net">news:42d69eb8@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Do you not see how =
silly this=20
is? To support a claim that eeye is not irresponsible you use =
a=20
statement from eeye that they are not irresponsible. Do you =
really=20
expect them to say they are culpable?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:42d695b7@w3.nls.net">news:42d695b7@w3.nls.net</A>...</DIV>No=
,=20
I'm claiming that they could have taken control of almost every=20
windows<BR>computer that connects to the internet at any time =
since the=20
"information<BR>anarchy" program started allowing Microsoft to =
take 188=20
days to patch the<BR>most critical of exploits. Prior to that =
their window=20
from<BR>discovery/publishing to patch was at most 2 weeks. But now =
with=20
standard<BR>patch times taking roughly half a year there is always =
a root=20
exploit or two<BR>that they know about that is unpatched. At the =
momemt=20
there are 4 for<BR>windows and several more for other very common =
windows=20
programs and those<BR>are just the ones eeye discovered, not the =
full=20
batch of all known root<BR>level exploits for windows.<BR><BR>As =
for=20
Rich's attitude about eeye being irresponsible, this article =
about<BR>the=20
"information anarchy" program shows eeye's initial stance on=20
things<BR>pretty clearly.<BR><BR><A=20
=
href=3D"http://www.securityfocus.com/news/281">http://www.securityfocus.c=
om/news/281</A><BR><BR>"What's=20
being created here is an information cartel," says Elias =
Levy,<BR>former=20
moderator of the Bugtraq security mailing list, a standard outlet=20
for<BR>'full disclosure' security information. "It actually =
benefits=20
security<BR>vendors to have limited vulnerability information, =
because it=20
makes them<BR>look better in the eyes of their customers," says =
Levy.=20
(Levy is CTO of<BR>SecurityFocus).<BR><BR>Under the plan, member =
companies=20
would share detailed information during the<BR>30-day grace period =
with=20
law enforcement agencies, infrastructure =
protection<BR>organizations, and=20
"other communities in which enforceable frameworks exist<BR>to =
deter=20
onward uncontrolled distribution." The last category would =
allow<BR>member=20
companies to share details with clients under a=20
non-disclosure<BR>agreement, and to share details with one =
another.=20
"They're not going to ban<BR>it among themselves," says Levy. =
"They might=20
be willing to limit the public<BR>access to this information, but =
I highly=20
doubt that they'll limit it among<BR>each other."<BR><BR>Marc =
Maiffret,=20
co-founder of eEye Digital Security, agrees, and charges =
that<BR>the=20
coalition was formed for the commercial advantage of its members,=20
rather<BR>than the well-being of the Internet.<BR><BR>"If it =
becomes hard=20
to release vulnerabilities, that's a good way for<BR>Microsoft to =
get rid=20
of some embarrassment," says Maiffret.<BR><BR>Maiffret's company =
is=20
responsible for discovering some of the most serious<BR>Microsoft =
security=20
holes in recent years -- vulnerabilities in the company's<BR>IIS =
web=20
server product that allow attackers to gain remote control of=20
the<BR>system. He says eEye cooperates with vendors, and doesn't =
release=20
advisories<BR>until a company has had a chance to produce patches =
for the=20
security hole.<BR>But Maiffret rejects the idea of holding back on =
technical details, and<BR>warns that the new coalition may =
alienate=20
independent security researchers.<BR><BR>"People have to do it =
Microsoft's=20
way or they'll have this group telling<BR>them that they're acting =
irresponsibly," says Maiffret. "It's going to drive<BR>people into =
the=20
underground, and could lead to more people breaking=20
into<BR>computers."<BR><BR><BR>Geo.<BR><BR>"John Beckett" <<A=20
=
href=3D"mailto:FirstnameSurname@compuserve.com.omit">FirstnameSurname@com=
puserve.com.omit</A>>=20
wrote in message<BR><A=20
=
href=3D"news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com">news:nf1cd1pblvd=
mv4gpcp55g3671etghdujsm@4ax.com</A>...<BR>>=20
"Rich" <@> wrote in message <A=20
=
href=3D"news:<42d5ef53@w3.nls.net">news:<42d5ef53@w3.nls.net</A>>:<=
BR>>=20
> You made a claim that 95% of computers are vulnerable to the =
point=20
that<BR>eeye could own them.<BR>><BR>> I thought Geo's claim =
was=20
that if eeye had not been publishing the bugs<BR>> they had =
found (and=20
just kept them to themselves) over the last couple of<BR>> =
years, then=20
eeye could have owned 95% of the Windows computers =
connected<BR>> to=20
the Internet now.<BR>><BR>> Assuming that no one filled this =
hypothetical vacuum left by eeye saying<BR>> nothing, Geo's =
claim looks=20
very credible to me (with pointless argument<BR>> about whether =
it's=20
really 95% or 85% etc).<BR>><BR>>=20
=
John<BR>><BR><BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>=
------=_NextPart_000_0210_01C58881.63AC6B90--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|