On Fri, 24 Mar 2006, Gadi Evron wrote:
On Thu, 23 Mar 2006, Claus Assmann wrote:
It took Sendmail a mounth to fix this. A mounth.
No. It took sendmail a week to fix this. The rest of the time was
used to coordinate the release with all the involved vendors etc.
There are a few choices, full disclosure and "responsible disclosure" are
some. You can't do both. Releasing it out of nowhere, obfuscated in very
ineffective way, isn't it.
Not when it's critical infrastructure. With critical internet
infrastructure you need to be a tad bit smarter than that.
How would you suggest that they release this?
I think that they did it in a pretty responsible way. They where
notified of the problem, they fixed it and gave vendors who use/ship
the product some time to create and test patches, then it became public.
This was done in a month, any longer and I would think that they would be
putting us at risk, but I think that this is a very reasonable response.
0Day full-disclosure eith a 'sploit would have been more trouble for me
;-) (I'm probably not alone with that).
Todd
