>-----Original Message----- >From: Jay Libove [mailto:libove@xxxxxxxxxxx] >I think Simple Nomad wrote an excellent analysis of the problem of a COTS >vendor (in this case, Sybase) "requesting" (make legal threats) against a >security research firm to not disclose the details of a discovered vulnerability. I second your conclusion to Simple Nomad's analysis. I unfortunately have had and continue to have the same experience with vendors. Some that are vendors of security products and I honestly expected to be positive. </naïve> >To that end, I have encouraged my employer to perform some commercial >activism by contacting the commercial product vendor, as a concerned >customer, and suggesting that we disapprove of their policy of using legal >threats to keep the vulnerability details quiet. I have further suggested >that we should copy such notice to our lobbyists / elected representatives. Excellent. If everyone on these lists that is a licensed/paying user of Sybase products contacted Sybase to express their concern and displeasure, their stance would quickly change. Let them know you'll vote with your dollars. Anyone remember when someone published Carly the HP CEO's email address to a certain list and the 1,000's of emails she got over the Snosoft lawsuit? (I think it was Snosoft, wasn't it?) HP changed their tune really fast and claimed "it was all a misunderstanding". How about a little noise from the community. NGS should drop a name or an email address if they find they cannot make progress on this. Also, where are the clueless media articles about this? Where are the media folks for that matter? I know you guys are reading BT. Stop writing about Microsoft-funded studies analyzing Linux security and write about some real information. Arian Evans Sr. Security Engineer FishNet Security Phone: 816.421.6611 Toll Free: 888.732.9406 Fax: 816.421.6677 http://www.fishnetsecurity.com The information transmitted in this e-mail is intended only for the addressee and may contain confidential and/or privileged material. Any interception, review, retransmission, dissemination, or other use of, or taking of any action upon this information by persons or entities other than the intended recipient is prohibited by law and may subject them to criminal or civil liability. If you received this communication in error, please contact us immediately at 816.421.6611, and delete the communication from any computer or network system.
