Text 6045, 365 rader
Skriven 2005-07-14 21:25:28 av Geo (1:379/45)
Kommentar till text 6037 av Rich (1:379/45)
Ärende: Re: eeye's irresponsible self-serving behavior
======================================================
From: "Geo" <georger@nls.net>
This is a multi-part message in MIME format.
------=_NextPart_000_03EE_01C588BA.8E7B7F80
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
I think it's important to understand where eeye is coming from in order = to
understand why they do what they do. They promote the fact that = exploits
exist to sell their software, they release the details of the = exploits so you
don't have to pay security companies for that = information. That second part
is really in the spirit in which the = internet was formed, information
sharing. The whole "information = anarchy" mentality is really anti-internet to
anyone who's been around = since before Microsoft gained so much control over
the net.
Geo.
"Rich" <@> wrote in message news:42d6d98c@w3.nls.net...
Then I misunderstood as you started the sentence from which you =
quoted with "As for Rich's attitude about eeye being irresponsible," as = if
what followed had some relevance.
Rich
"Geo" <georger@nls.net> wrote in message =
news:42d6c031$2@w3.nls.net...
What I said was "to show eeye's initial stance" and I then go on to =
quote eeye. How can that not make sense to you?
Geo.
"Rich" <@> wrote in message news:42d69eb8@w3.nls.net...
Do you not see how silly this is? To support a claim that eeye =
is not irresponsible you use a statement from eeye that they are not =
irresponsible. Do you really expect them to say they are culpable?
Rich
"Geo" <georger@nls.net> wrote in message =
news:42d695b7@w3.nls.net...
No, I'm claiming that they could have taken control of almost =
every windows
computer that connects to the internet at any time since the =
"information
anarchy" program started allowing Microsoft to take 188 days to =
patch the
most critical of exploits. Prior to that their window from
discovery/publishing to patch was at most 2 weeks. But now with =
standard
patch times taking roughly half a year there is always a root =
exploit or two
that they know about that is unpatched. At the momemt there are =
4 for
windows and several more for other very common windows programs =
and those
are just the ones eeye discovered, not the full batch of all =
known root
level exploits for windows.
As for Rich's attitude about eeye being irresponsible, this =
article about
the "information anarchy" program shows eeye's initial stance on =
things
pretty clearly.
http://www.securityfocus.com/news/281
"What's being created here is an information cartel," says Elias =
Levy,
former moderator of the Bugtraq security mailing list, a =
standard outlet for
'full disclosure' security information. "It actually benefits =
security
vendors to have limited vulnerability information, because it =
makes them
look better in the eyes of their customers," says Levy. (Levy is =
CTO of
SecurityFocus).
Under the plan, member companies would share detailed =
information during the
30-day grace period with law enforcement agencies, =
infrastructure protection
organizations, and "other communities in which enforceable =
frameworks exist
to deter onward uncontrolled distribution." The last category =
would allow
member companies to share details with clients under a =
non-disclosure
agreement, and to share details with one another. "They're not =
going to ban
it among themselves," says Levy. "They might be willing to limit =
the public
access to this information, but I highly doubt that they'll =
limit it among
each other."
Marc Maiffret, co-founder of eEye Digital Security, agrees, and =
charges that
the coalition was formed for the commercial advantage of its =
members, rather
than the well-being of the Internet.
"If it becomes hard to release vulnerabilities, that's a good =
way for
Microsoft to get rid of some embarrassment," says Maiffret.
Maiffret's company is responsible for discovering some of the =
most serious
Microsoft security holes in recent years -- vulnerabilities in =
the company's
IIS web server product that allow attackers to gain remote =
control of the
system. He says eEye cooperates with vendors, and doesn't =
release advisories
until a company has had a chance to produce patches for the =
security hole.
But Maiffret rejects the idea of holding back on technical =
details, and
warns that the new coalition may alienate independent security =
researchers.
"People have to do it Microsoft's way or they'll have this group =
telling
them that they're acting irresponsibly," says Maiffret. "It's =
going to drive
people into the underground, and could lead to more people =
breaking into
computers."
Geo.
"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in =
message
news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com...
> "Rich" <@> wrote in message news:<42d5ef53@w3.nls.net>:
> > You made a claim that 95% of computers are vulnerable to the =
point that
eeye could own them.
>
> I thought Geo's claim was that if eeye had not been publishing =
the bugs
> they had found (and just kept them to themselves) over the =
last couple of
> years, then eeye could have owned 95% of the Windows computers =
connected
> to the Internet now.
>
> Assuming that no one filled this hypothetical vacuum left by =
eeye saying
> nothing, Geo's claim looks very credible to me (with pointless =
argument
> about whether it's really 95% or 85% etc).
>
> John
>
------=_NextPart_000_03EE_01C588BA.8E7B7F80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1505" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>I think it's important to understand =
where eeye is=20
coming from in order to understand why they do what they do. They = promote
the=20
fact that exploits exist to sell their software, they release the = details of
the=20
exploits so you don't have to pay security companies for that = information.
That=20
second part is really in the spirit in which the internet was formed,=20
information sharing. The whole "information anarchy" mentality is =
really=20
anti-internet to anyone who's been around since before Microsoft gained = so
much=20
control over the net.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d6d98c@w3.nls.net">news:42d6d98c@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Then I misunderstood as =
you started=20
the sentence from which you quoted with "<FONT face=3D"Times New =
Roman"=20
size=3D3>As for Rich's attitude about eeye being =
irresponsible,</FONT>" as if=20
what followed had some relevance.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:42d6c031$2@w3.nls.net">news:42d6c031$2@w3.nls.net</A>...</DI=
V>
<DIV><FONT face=3DArial size=3D2>What I said was "to show eeye's =
initial stance"=20
and I then go on to quote eeye. How can that not make sense to=20
you?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d69eb8@w3.nls.net">news:42d69eb8@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Do you not see how =
silly this=20
is? To support a claim that eeye is not irresponsible you =
use a=20
statement from eeye that they are not irresponsible. Do you =
really=20
expect them to say they are culpable?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:42d695b7@w3.nls.net">news:42d695b7@w3.nls.net</A>...</DIV>No=
,=20
I'm claiming that they could have taken control of almost every=20
windows<BR>computer that connects to the internet at any time =
since the=20
"information<BR>anarchy" program started allowing Microsoft to =
take 188=20
days to patch the<BR>most critical of exploits. Prior to that =
their=20
window from<BR>discovery/publishing to patch was at most 2 =
weeks. But=20
now with standard<BR>patch times taking roughly half a year =
there is=20
always a root exploit or two<BR>that they know about that is =
unpatched.=20
At the momemt there are 4 for<BR>windows and several more for =
other very=20
common windows programs and those<BR>are just the ones eeye =
discovered,=20
not the full batch of all known root<BR>level exploits for=20
windows.<BR><BR>As for Rich's attitude about eeye being =
irresponsible,=20
this article about<BR>the "information anarchy" program shows =
eeye's=20
initial stance on things<BR>pretty clearly.<BR><BR><A=20
=
href=3D"http://www.securityfocus.com/news/281">http://www.securityfocus.c=
om/news/281</A><BR><BR>"What's=20
being created here is an information cartel," says Elias =
Levy,<BR>former=20
moderator of the Bugtraq security mailing list, a standard =
outlet=20
for<BR>'full disclosure' security information. "It actually =
benefits=20
security<BR>vendors to have limited vulnerability information, =
because=20
it makes them<BR>look better in the eyes of their customers," =
says Levy.=20
(Levy is CTO of<BR>SecurityFocus).<BR><BR>Under the plan, member =
companies would share detailed information during the<BR>30-day =
grace=20
period with law enforcement agencies, infrastructure=20
protection<BR>organizations, and "other communities in which =
enforceable=20
frameworks exist<BR>to deter onward uncontrolled distribution." =
The last=20
category would allow<BR>member companies to share details with =
clients=20
under a non-disclosure<BR>agreement, and to share details with =
one=20
another. "They're not going to ban<BR>it among themselves," says =
Levy.=20
"They might be willing to limit the public<BR>access to this=20
information, but I highly doubt that they'll limit it =
among<BR>each=20
other."<BR><BR>Marc Maiffret, co-founder of eEye Digital =
Security,=20
agrees, and charges that<BR>the coalition was formed for the =
commercial=20
advantage of its members, rather<BR>than the well-being of the=20
Internet.<BR><BR>"If it becomes hard to release vulnerabilities, =
that's=20
a good way for<BR>Microsoft to get rid of some embarrassment," =
says=20
Maiffret.<BR><BR>Maiffret's company is responsible for =
discovering some=20
of the most serious<BR>Microsoft security holes in recent years =
--=20
vulnerabilities in the company's<BR>IIS web server product that =
allow=20
attackers to gain remote control of the<BR>system. He says eEye=20
cooperates with vendors, and doesn't release advisories<BR>until =
a=20
company has had a chance to produce patches for the security=20
hole.<BR>But Maiffret rejects the idea of holding back on =
technical=20
details, and<BR>warns that the new coalition may alienate =
independent=20
security researchers.<BR><BR>"People have to do it Microsoft's =
way or=20
they'll have this group telling<BR>them that they're acting=20
irresponsibly," says Maiffret. "It's going to drive<BR>people =
into the=20
underground, and could lead to more people breaking=20
into<BR>computers."<BR><BR><BR>Geo.<BR><BR>"John Beckett" <<A =
=
href=3D"mailto:FirstnameSurname@compuserve.com.omit">FirstnameSurname@com=
puserve.com.omit</A>>=20
wrote in message<BR><A=20
=
href=3D"news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com">news:nf1cd1pblvd=
mv4gpcp55g3671etghdujsm@4ax.com</A>...<BR>>=20
"Rich" <@> wrote in message <A=20
=
href=3D"news:<42d5ef53@w3.nls.net">news:<42d5ef53@w3.nls.net</A>>:<=
BR>>=20
> You made a claim that 95% of computers are vulnerable to =
the point=20
that<BR>eeye could own them.<BR>><BR>> I thought Geo's =
claim was=20
that if eeye had not been publishing the bugs<BR>> they had =
found=20
(and just kept them to themselves) over the last couple =
of<BR>>=20
years, then eeye could have owned 95% of the Windows computers=20
connected<BR>> to the Internet now.<BR>><BR>> Assuming =
that no=20
one filled this hypothetical vacuum left by eeye saying<BR>> =
nothing,=20
Geo's claim looks very credible to me (with pointless =
argument<BR>>=20
about whether it's really 95% or 85% etc).<BR>><BR>>=20
=
John<BR>><BR><BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE><=
/BODY></HTML>
------=_NextPart_000_03EE_01C588BA.8E7B7F80--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|