On Thu, 23 Mar 2006, Eric Allman wrote: <snip mostly relevant good replies by Mr. Allman> > Talk to the vendors. I've seen quite a few of their advisories come > by. After or before it hit the news? You may be able to alert vendors, but the problem with critical infrastructure is that is widely deployed around the world. Releasing the way you did is irresponsible. You can do non-disclosure for a while or full disclosure, you can't do both. > > Commentary == personal opinion > Yes, that's true. If it's exploitable and people don't update, then > those people who choose to ignore the problem will be vulnerable. > You could say that about every vulnerability that has ever existed. Indeed. And yet blaming the user is not how you solve the problem, is it? The Internet being insecure is a give, do you blame the Internet for telnet not being secure, or do you create SSH? How long before enough Sendmail servers globally are patched? > > A mounth! > > Are you suggesting that it would have been better for us to have > released the problem without giving vendors any time at all to get it > integrated? I think that would be seriously irresponsible. I agree, my point is that if you release, do it as soon as you can as you ARE critical infrastructure. If you want to let vendors get something done, wait a whole lot longer than a month. Gadi.
