:: NEWS COCKTAIL aka BlahBlahBlog ::
"Everything is being compressed into tiny tablets. You take a little pill of news every day - 23 minutes - and that's supposed to be enough." -Walter Cronkite, RE TV news. The Web has changed that for many, however, and here is an extra dose for your daily news cocktail. This prescription tends to include surveillance and now war-related links, along with the occasional pop culture junk and whatever else seizes my attention as I scan online news sites.:: 6.05.2003 ::
:: RE Full Disclosure & Online Security ::
From CNET News.com:
Group drafts truce in security dispute
By Robert Lemos
A security coalition has published draft guidelines for issuing bug alerts, a bid to temper a hot debate over when and how alerts should be released. The draft rules were released Wednesday by the Organization for Internet Safety (OIS), a group composed of software companies and security firms, which have found themselves on opposite sides of the debate.
The OIS guidelines call on application makers to respond within seven days to a researcher's notification of a vulnerability in their software and to attempt to create a patch for that flaw within 30 days. On the other side, the proposed rules require researchers to keep details of a flaw secret for at least 30 days after the release of a software patch for it.
In the early 1990s, several researchers and hackers revolted against the secrecy that software companies maintained regarding the security of their products by releasing flaw information to the public. Because application makers were generally slow to respond to security problems, such news of a vulnerability would frequently be published before any patch had been issued.
"If we don't have details, we are just going on the word of the software vendors and a small group of trusted companies," said Marc Maiffret, chief hacking officer at security firm eEye Digital Security. "That's not good. You are hoping that these few people are doing it right."
posted by me
:: 9:45:00 AM [+] ::
...
