Text 6055, 408 rader
Skriven 2005-07-14 20:38:02 av Rich (1:379/45)
Kommentar till text 6045 av Geo (1:379/45)
Ärende: Re: eeye's irresponsible self-serving behavior
======================================================
From: "Rich" <@>
This is a multi-part message in MIME format.
------=_NextPart_000_0024_01C588B3.EE91C020
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
First off, what they say and what they do need not match. I don't =
care what they say or what excuses they make. My opinion of them is = based on
what they do. What they do is cause great harm to others for = their own
financial gain. If you want to argue religion go find = yourself someone that
cares about silly religious debates. A great deal = of harm has been done in
the name of religion and I find religious = justifications inexcusable.
Rich
"Geo" <georger@nls.net> wrote in message news:42d71018@w3.nls.net...
I think it's important to understand where eeye is coming from in =
order to understand why they do what they do. They promote the fact that =
exploits exist to sell their software, they release the details of the =
exploits so you don't have to pay security companies for that = information.
That second part is really in the spirit in which the = internet was formed,
information sharing. The whole "information = anarchy" mentality is really
anti-internet to anyone who's been around = since before Microsoft gained so
much control over the net.
Geo.
"Rich" <@> wrote in message news:42d6d98c@w3.nls.net...
Then I misunderstood as you started the sentence from which you =
quoted with "As for Rich's attitude about eeye being irresponsible," as = if
what followed had some relevance.
Rich
"Geo" <georger@nls.net> wrote in message =
news:42d6c031$2@w3.nls.net...
What I said was "to show eeye's initial stance" and I then go on =
to quote eeye. How can that not make sense to you?
Geo.
"Rich" <@> wrote in message news:42d69eb8@w3.nls.net...
Do you not see how silly this is? To support a claim that =
eeye is not irresponsible you use a statement from eeye that they are = not
irresponsible. Do you really expect them to say they are culpable?
Rich
"Geo" <georger@nls.net> wrote in message =
news:42d695b7@w3.nls.net...
No, I'm claiming that they could have taken control of almost =
every windows
computer that connects to the internet at any time since the =
"information
anarchy" program started allowing Microsoft to take 188 days =
to patch the
most critical of exploits. Prior to that their window from
discovery/publishing to patch was at most 2 weeks. But now =
with standard
patch times taking roughly half a year there is always a root =
exploit or two
that they know about that is unpatched. At the momemt there =
are 4 for
windows and several more for other very common windows =
programs and those
are just the ones eeye discovered, not the full batch of all =
known root
level exploits for windows.
As for Rich's attitude about eeye being irresponsible, this =
article about
the "information anarchy" program shows eeye's initial stance =
on things
pretty clearly.
http://www.securityfocus.com/news/281
"What's being created here is an information cartel," says =
Elias Levy,
former moderator of the Bugtraq security mailing list, a =
standard outlet for
'full disclosure' security information. "It actually benefits =
security
vendors to have limited vulnerability information, because it =
makes them
look better in the eyes of their customers," says Levy. (Levy =
is CTO of
SecurityFocus).
Under the plan, member companies would share detailed =
information during the
30-day grace period with law enforcement agencies, =
infrastructure protection
organizations, and "other communities in which enforceable =
frameworks exist
to deter onward uncontrolled distribution." The last category =
would allow
member companies to share details with clients under a =
non-disclosure
agreement, and to share details with one another. "They're not =
going to ban
it among themselves," says Levy. "They might be willing to =
limit the public
access to this information, but I highly doubt that they'll =
limit it among
each other."
Marc Maiffret, co-founder of eEye Digital Security, agrees, =
and charges that
the coalition was formed for the commercial advantage of its =
members, rather
than the well-being of the Internet.
"If it becomes hard to release vulnerabilities, that's a good =
way for
Microsoft to get rid of some embarrassment," says Maiffret.
Maiffret's company is responsible for discovering some of the =
most serious
Microsoft security holes in recent years -- vulnerabilities in =
the company's
IIS web server product that allow attackers to gain remote =
control of the
system. He says eEye cooperates with vendors, and doesn't =
release advisories
until a company has had a chance to produce patches for the =
security hole.
But Maiffret rejects the idea of holding back on technical =
details, and
warns that the new coalition may alienate independent security =
researchers.
"People have to do it Microsoft's way or they'll have this =
group telling
them that they're acting irresponsibly," says Maiffret. "It's =
going to drive
people into the underground, and could lead to more people =
breaking into
computers."
Geo.
"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in =
message
news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com...
> "Rich" <@> wrote in message news:<42d5ef53@w3.nls.net>:
> > You made a claim that 95% of computers are vulnerable to =
the point that
eeye could own them.
>
> I thought Geo's claim was that if eeye had not been =
publishing the bugs
> they had found (and just kept them to themselves) over the =
last couple of
> years, then eeye could have owned 95% of the Windows =
computers connected
> to the Internet now.
>
> Assuming that no one filled this hypothetical vacuum left by =
eeye saying
> nothing, Geo's claim looks very credible to me (with =
pointless argument
> about whether it's really 95% or 85% etc).
>
> John
>
------=_NextPart_000_0024_01C588B3.EE91C020
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2668" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2> First off, what they say =
and what they=20
do need not match. I don't care what they say or what excuses they =
make. My opinion of them is based on what they do. What they = do
is=20
cause great harm to others for their own financial gain. If = you
want=20
to argue religion go find yourself someone that cares about silly =
religious=20
debates. A great deal of harm has been done in the name of = religion and
I=20
find religious justifications inexcusable.</FONT></DIV><FONT = face=3DArial
size=3D2>
<DIV><BR>Rich</DIV>
<DIV></FONT> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote=20
in message <A=20
=
href=3D"news:42d71018@w3.nls.net">news:42d71018@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2>I think it's important to understand =
where eeye=20
is coming from in order to understand why they do what they do. They =
promote=20
the fact that exploits exist to sell their software, they release the =
details=20
of the exploits so you don't have to pay security companies for that=20
information. That second part is really in the spirit in which the =
internet=20
was formed, information sharing. The whole "information anarchy"=20
mentality is really anti-internet to anyone who's been around =
since=20
before Microsoft gained so much control over the net.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d6d98c@w3.nls.net">news:42d6d98c@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Then I misunderstood =
as you=20
started the sentence from which you quoted with "<FONT=20
face=3D"Times New Roman" size=3D3>As for Rich's attitude about eeye =
being=20
irresponsible,</FONT>" as if what followed had some =
relevance.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:42d6c031$2@w3.nls.net">news:42d6c031$2@w3.nls.net</A>...</DI=
V>
<DIV><FONT face=3DArial size=3D2>What I said was "to show eeye's =
initial=20
stance" and I then go on to quote eeye. How can that not make =
sense to=20
you?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:42d69eb8@w3.nls.net">news:42d69eb8@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Do you not see how =
silly this=20
is? To support a claim that eeye is not irresponsible you =
use a=20
statement from eeye that they are not irresponsible. Do =
you really=20
expect them to say they are culpable?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: =
5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A=20
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote =
in message=20
<A=20
=
href=3D"news:42d695b7@w3.nls.net">news:42d695b7@w3.nls.net</A>...</DIV>No=
,=20
I'm claiming that they could have taken control of almost =
every=20
windows<BR>computer that connects to the internet at any time =
since=20
the "information<BR>anarchy" program started allowing =
Microsoft to=20
take 188 days to patch the<BR>most critical of exploits. Prior =
to that=20
their window from<BR>discovery/publishing to patch was at most =
2=20
weeks. But now with standard<BR>patch times taking roughly =
half a year=20
there is always a root exploit or two<BR>that they know about =
that is=20
unpatched. At the momemt there are 4 for<BR>windows and =
several more=20
for other very common windows programs and those<BR>are just =
the ones=20
eeye discovered, not the full batch of all known root<BR>level =
exploits for windows.<BR><BR>As for Rich's attitude about eeye =
being=20
irresponsible, this article about<BR>the "information anarchy" =
program=20
shows eeye's initial stance on things<BR>pretty =
clearly.<BR><BR><A=20
=
href=3D"http://www.securityfocus.com/news/281">http://www.securityfocus.c=
om/news/281</A><BR><BR>"What's=20
being created here is an information cartel," says Elias=20
Levy,<BR>former moderator of the Bugtraq security mailing =
list, a=20
standard outlet for<BR>'full disclosure' security information. =
"It=20
actually benefits security<BR>vendors to have limited =
vulnerability=20
information, because it makes them<BR>look better in the eyes =
of their=20
customers," says Levy. (Levy is CTO =
of<BR>SecurityFocus).<BR><BR>Under=20
the plan, member companies would share detailed information =
during=20
the<BR>30-day grace period with law enforcement agencies,=20
infrastructure protection<BR>organizations, and "other =
communities in=20
which enforceable frameworks exist<BR>to deter onward =
uncontrolled=20
distribution." The last category would allow<BR>member =
companies to=20
share details with clients under a =
non-disclosure<BR>agreement, and to=20
share details with one another. "They're not going to =
ban<BR>it among=20
themselves," says Levy. "They might be willing to limit the=20
public<BR>access to this information, but I highly doubt that =
they'll=20
limit it among<BR>each other."<BR><BR>Marc Maiffret, =
co-founder of=20
eEye Digital Security, agrees, and charges that<BR>the =
coalition was=20
formed for the commercial advantage of its members, =
rather<BR>than the=20
well-being of the Internet.<BR><BR>"If it becomes hard to =
release=20
vulnerabilities, that's a good way for<BR>Microsoft to get rid =
of some=20
embarrassment," says Maiffret.<BR><BR>Maiffret's company is=20
responsible for discovering some of the most =
serious<BR>Microsoft=20
security holes in recent years -- vulnerabilities in the=20
company's<BR>IIS web server product that allow attackers to =
gain=20
remote control of the<BR>system. He says eEye cooperates with =
vendors,=20
and doesn't release advisories<BR>until a company has had a =
chance to=20
produce patches for the security hole.<BR>But Maiffret rejects =
the=20
idea of holding back on technical details, and<BR>warns that =
the new=20
coalition may alienate independent security=20
researchers.<BR><BR>"People have to do it Microsoft's way or =
they'll=20
have this group telling<BR>them that they're acting =
irresponsibly,"=20
says Maiffret. "It's going to drive<BR>people into the =
underground,=20
and could lead to more people breaking=20
into<BR>computers."<BR><BR><BR>Geo.<BR><BR>"John Beckett" =
<<A=20
=
href=3D"mailto:FirstnameSurname@compuserve.com.omit">FirstnameSurname@com=
puserve.com.omit</A>>=20
wrote in message<BR><A=20
=
href=3D"news:nf1cd1pblvdmv4gpcp55g3671etghdujsm@4ax.com">news:nf1cd1pblvd=
mv4gpcp55g3671etghdujsm@4ax.com</A>...<BR>>=20
"Rich" <@> wrote in message <A=20
=
href=3D"news:<42d5ef53@w3.nls.net">news:<42d5ef53@w3.nls.net</A>>:<=
BR>>=20
> You made a claim that 95% of computers are vulnerable to =
the=20
point that<BR>eeye could own them.<BR>><BR>> I thought =
Geo's=20
claim was that if eeye had not been publishing the =
bugs<BR>> they=20
had found (and just kept them to themselves) over the last =
couple=20
of<BR>> years, then eeye could have owned 95% of the =
Windows=20
computers connected<BR>> to the Internet =
now.<BR>><BR>>=20
Assuming that no one filled this hypothetical vacuum left by =
eeye=20
saying<BR>> nothing, Geo's claim looks very credible to me =
(with=20
pointless argument<BR>> about whether it's really 95% or =
85%=20
etc).<BR>><BR>>=20
=
John<BR>><BR><BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE><=
/BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_0024_01C588B3.EE91C020--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|