[gentoo-security] Profiting on the Community (wasTCP vulnerability)

[Daniel Brandt]

I don't think jealosy has anything to do with it. But seeing how some
in the industry profit out of freely available exploit code and
original research, without giving either credit or some of the profit
back to the originators, I understand them. 

Not all knowledgeable in the computer security field are employed by a
security company (and, speaking of my self, some are even unemployed),
some do their stuff for the fun of it. How fun do you think it would
be for a guy hacking away at some exploit code in his dormroom for
free, only to discover it the next day in an advisory. That would piss
me off badly.

In '98 things were a bit different, there weren't the same amount of
money to be made, and people with good skills could still be self
employed and decide for their self wether or not to make money on
their stuff. Also, the research was welcomed, if only as an eyeopener
for those who thought they were safe with their chice of software.

Today more than ever, vendors are moving towards secrecy when it comes
to security problems. Closed trusted-parties-only mailinglists and
patching software in secret are examples of this. Full disclosure has
become a place where leeches feed, and ironically, you can be accused
of irresponibility if you publish truly orignial stuff. 

Full disclosure is however the best way to spread the word of
problems (IMO). When security companies get tired of trying to be the
first to announce an advisory, it might even become a nice place again.

-----Original Message-----
From: Devon <devon@×××××.org>
To: gentoo-security@l.g.o
Date: Thu, 22 Apr 2004 03:10:18 -0400
Subject: Re: [gentoo-security] TCP vulnerability 

On Thursday 22 April 2004 02:34 am, Daniel Brandt wrote:
> It sure looks like another silly attempt to make a name in the security
> industry by publishing old research; profiting on the community if you
> will.
>
> Nothing new, only the same thing that has been pushing more and more people
> to not release their research to the public.

Perhaps I am missing something obvious, but how do others rehashing prior 
research make one not want to publish their new original research? If no one 
spoke publically about the TCP ISN problems back in '98 (or whatever), we 
couldn't sit here today and say we knew about this issue already.

Are these people afraid that when they release their research they will not 
get credited and then someone else comes later, states the same thing, and 
gets the whole Internet in an up roar? Jealousy?

Devon

--
gentoo-security@g.o mailing list





--
gentoo-security@g.o mailing list