Text 6033, 298 rader
Skriven 2005-07-14 15:43:54 av Geo (1:379/45)
Kommentar till text 6028 av Rich (1:379/45)
Ärende: Re: eeye's irresponsible self-serving behavior
======================================================
From: "Geo" <georger@nls.net>
This is a multi-part message in MIME format.
------=_NextPart_000_02E3_01C5888A.D7324EF0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
What I said was "to show eeye's initial stance" and I then go on to = quote
eeye. How can that not make sense to you?
Geo.
"Rich" <@> wrote in message news:42d69eb8@w3.nls.net...
Do you not see how silly this is? To support a claim that eeye is =
not irresponsible you use a statement from eeye that they are not =
irresponsible. Do you really expect them to say they are culpable?
Rich
"Geo" <georger@nls.net> wrote in message news:42d695b7@w3.nls.net...
No, I'm claiming that they could have taken control of almost every =
windows
computer that connects to the internet at any time since the =
"information
anarchy" program started allowing Microsoft to take 188 days to =
patch the
most critical of exploits. Prior to that their window from
discovery/publishing to patch was at most 2 weeks. But now with =
standard
patch times taking roughly half a year there is always a root =
exploit or two
that they know about that is unpatched. At the momemt there are 4 =
for
windows and several more for other very common windows programs and =
those
are just the ones eeye discovered, not the full batch of all known =
root
level exploits for windows.
As for Rich's attitude about eeye being irresponsible, this article =
about
the "information anarchy" program shows eeye's initial stance on =
things
pretty clearly.
http://www.securityfocus.com/news/281
"What's being created here is an information cartel," says Elias =
Levy,
former moderator of the Bugtraq security mailing list, a standard =
outlet for
'full disclosure' security information. "It actually benefits =
security
vendors to have limited vulnerability information, because it makes =
them
look better in the eyes of their customers," says Levy. (Levy is CTO =
of
SecurityFocus).
Under the plan, member companies would share detailed information =
during the
30-day grace period with law enforcement agencies, infrastructure =
protection
organizations, and "other communities in which enforceable =
frameworks exist
to deter onward uncontrolled distribution." The last category would =
allow
member companies to share details with clients under a =
non-disclosure
agreement, and to share details with one another. "They're not going =
to ban
it among themselves," says Levy. "They might be willing to limit the =
public
access to this information, but I highly doubt that they'll limit it =
among
each other."
Marc Maiffret, co-founder of eEye Digital Security, agrees, and =
charges that
the coalition was formed for the commercial advantage of its =
members, rather
than the well-being of the Internet.
"If it becomes hard to release vulnerabilities, that's a good way =
for
Microsoft to get rid of some embarrassment," says Maiffret.
Maiffret's company is responsible for discovering some of the most =
serious
Microsoft security holes in recent years -- vulnerabilities in the =
company's
IIS web server product that allow attackers to gain remote control =
of the
system. He says eEye cooperates with vendors, and doesn't release =
advisories
until a company has had a chance to produce patches for the security =
hole.
But Maiffret rejects the idea of holding back on technical details, =
and
warns that the new coalition may alienate independent security =
researchers.
"People have to do it Microsoft's way or they'll have this group =
telling
them that they're acting irresponsibly," says Maiffret. "It's going =
to drive
people into the underground, and could lead to more people breaking =
into
computers."
Geo.
"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in =
message
news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com...
> "Rich" <@> wrote in message news:<42d5ef53@w3.nls.net>:
> > You made a claim that 95% of computers are vulnerable to the =
point that
eeye could own them.
>
> I thought Geo's claim was that if eeye had not been publishing the =
bugs
> they had found (and just kept them to themselves) over the last =
couple of
> years, then eeye could have owned 95% of the Windows computers =
connected
> to the Internet now.
>
> Assuming that no one filled this hypothetical vacuum left by eeye =
saying
> nothing, Geo's claim looks very credible to me (with pointless =
argument
> about whether it's really 95% or 85% etc).
>
> John
>
------=_NextPart_000_02E3_01C5888A.D7324EF0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1505" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>What I said was "to show eeye's initial =
stance" and=20
I then go on to quote eeye. How can that not make sense to = you?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d69eb8@w3.nls.net">news:42d69eb8@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Do you not see how silly =
this=20
is? To support a claim that eeye is not irresponsible you use a=20
statement from eeye that they are not irresponsible. Do you =
really=20
expect them to say they are culpable?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:42d695b7@w3.nls.net">news:42d695b7@w3.nls.net</A>...</DIV>No=
, I'm=20
claiming that they could have taken control of almost every=20
windows<BR>computer that connects to the internet at any time since =
the=20
"information<BR>anarchy" program started allowing Microsoft to take =
188 days=20
to patch the<BR>most critical of exploits. Prior to that their =
window=20
from<BR>discovery/publishing to patch was at most 2 weeks. But now =
with=20
standard<BR>patch times taking roughly half a year there is always a =
root=20
exploit or two<BR>that they know about that is unpatched. At the =
momemt=20
there are 4 for<BR>windows and several more for other very common =
windows=20
programs and those<BR>are just the ones eeye discovered, not the =
full batch=20
of all known root<BR>level exploits for windows.<BR><BR>As for =
Rich's=20
attitude about eeye being irresponsible, this article about<BR>the=20
"information anarchy" program shows eeye's initial stance on=20
things<BR>pretty clearly.<BR><BR><A=20
=
href=3D"http://www.securityfocus.com/news/281">http://www.securityfocus.c=
om/news/281</A><BR><BR>"What's=20
being created here is an information cartel," says Elias =
Levy,<BR>former=20
moderator of the Bugtraq security mailing list, a standard outlet=20
for<BR>'full disclosure' security information. "It actually benefits =
security<BR>vendors to have limited vulnerability information, =
because it=20
makes them<BR>look better in the eyes of their customers," says =
Levy. (Levy=20
is CTO of<BR>SecurityFocus).<BR><BR>Under the plan, member companies =
would=20
share detailed information during the<BR>30-day grace period with =
law=20
enforcement agencies, infrastructure protection<BR>organizations, =
and "other=20
communities in which enforceable frameworks exist<BR>to deter onward =
uncontrolled distribution." The last category would allow<BR>member=20
companies to share details with clients under a =
non-disclosure<BR>agreement,=20
and to share details with one another. "They're not going to =
ban<BR>it among=20
themselves," says Levy. "They might be willing to limit the =
public<BR>access=20
to this information, but I highly doubt that they'll limit it =
among<BR>each=20
other."<BR><BR>Marc Maiffret, co-founder of eEye Digital Security, =
agrees,=20
and charges that<BR>the coalition was formed for the commercial =
advantage of=20
its members, rather<BR>than the well-being of the =
Internet.<BR><BR>"If it=20
becomes hard to release vulnerabilities, that's a good way =
for<BR>Microsoft=20
to get rid of some embarrassment," says Maiffret.<BR><BR>Maiffret's =
company=20
is responsible for discovering some of the most serious<BR>Microsoft =
security holes in recent years -- vulnerabilities in the =
company's<BR>IIS=20
web server product that allow attackers to gain remote control of=20
the<BR>system. He says eEye cooperates with vendors, and doesn't =
release=20
advisories<BR>until a company has had a chance to produce patches =
for the=20
security hole.<BR>But Maiffret rejects the idea of holding back on =
technical=20
details, and<BR>warns that the new coalition may alienate =
independent=20
security researchers.<BR><BR>"People have to do it Microsoft's way =
or=20
they'll have this group telling<BR>them that they're acting =
irresponsibly,"=20
says Maiffret. "It's going to drive<BR>people into the underground, =
and=20
could lead to more people breaking=20
into<BR>computers."<BR><BR><BR>Geo.<BR><BR>"John Beckett" <<A=20
=
href=3D"mailto:FirstnameSurname@compuserve.com.omit">FirstnameSurname@com=
puserve.com.omit</A>>=20
wrote in message<BR><A=20
=
href=3D"news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com">news:nf1cd1pblvd=
mv4gpcp55g3671etghdujsm@4ax.com</A>...<BR>>=20
"Rich" <@> wrote in message <A=20
=
href=3D"news:<42d5ef53@w3.nls.net">news:<42d5ef53@w3.nls.net</A>>:<=
BR>>=20
> You made a claim that 95% of computers are vulnerable to the =
point=20
that<BR>eeye could own them.<BR>><BR>> I thought Geo's claim =
was that=20
if eeye had not been publishing the bugs<BR>> they had found (and =
just=20
kept them to themselves) over the last couple of<BR>> years, then =
eeye=20
could have owned 95% of the Windows computers connected<BR>> to =
the=20
Internet now.<BR>><BR>> Assuming that no one filled this =
hypothetical=20
vacuum left by eeye saying<BR>> nothing, Geo's claim looks very =
credible=20
to me (with pointless argument<BR>> about whether it's really 95% =
or 85%=20
etc).<BR>><BR>>=20
John<BR>><BR><BR></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_02E3_01C5888A.D7324EF0--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|