ive dealt a bit with tipping point and their zdi. how about you learn how it works first, the come back and criticize it? you obviously dont understand the contest at cansecwest, or how zdi plays into it. i was there, it was a good conf. <div>
<br></div><div>but you need to learn how it works before you go ranting about it.... again...<br><br><div class="gmail_quote">On Thu, Apr 3, 2008 at 5:38 PM, n3td3v <<a href="mailto:xploitable@gmail.com">xploitable@gmail.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="Ih2E3d"><br>
On Thu, Apr 3, 2008 at 3:02 PM, Garrett M. Groff <<a href="mailto:groffg@gmgdesign.com">groffg@gmgdesign.com</a>> wrote:<br>
> Regarding the particular person in question, I'll defer to others who know<br>
> him (or her, or they, or whomever) better than I do. Instead, I'll say that,<br>
> generally, on lists like FD, there is a minority of out-spoken personalities<br>
> who sadly support the stereotypical hacker persona: condescending egoists<br>
> who are socially inept and emotionally charged when discussing topics that<br>
> relate to their knowledge domain. That's unfortunate, since the broader IT<br>
> security community is poorly represented due to attention-seeking zealots.<br>
><br>
> Regarding the idea of "oulawing security conference spamming," I'd say the<br>
> literal idea of outlawing cross-posts to multiple security mailing lists is<br>
> a bad idea. The idea that the legislature should write into law legislation<br>
> that reduces our freedom in such a sense is a slippery slope borne of<br>
> emotionalism and narrowness. What else should the government do to curtail<br>
> our freedoms? I tend to side with libertarian types (though I don't call<br>
> myself a "libertarian" un-qualified) on what the government should do and<br>
> what they should not do. And micro-manage security mailing lists is<br>
> something they should not do. It's a bad idea and would make a dreadful<br>
> precedent.<br>
<br>
</div>Full-Disclosure is ment to be about free source, not making money. I'm<br>
against people who make money come on the mailing lists, its<br>
commerical spam. We can't allow this to continue, here are what I<br>
don't like:<br>
<br>
- Come to our conference - profit... buy our ticket, get a macbook prize.<br>
<br>
- Hacking challenge prize - profit... they give you $5000 and sell it<br>
to the vendor for a lot more.<br>
<br>
- Train to use our software -profit... over priced training for<br>
software... not interested.<br>
<br>
On the issue of how much a vulnerability is worth, the prices are not<br>
regulated, we need regulation into how much a vulnerability costs,<br>
because the prices right now are wild. We need to take vulnerability<br>
pricing off the blackmarket and onto a legitimate central website for<br>
selling vulnerabilities, or cash rewards for disclosing a<br>
vulnerability to a particular company or organisation. I don't like<br>
sites like digital armaments which when i visited it, the content and<br>
answers they gave were questionable, and people have complained about<br>
digital armaments in the past. Its time to get pricing regulated and<br>
defined, so everyone knows whos being joe jobbed and who isn't.<br>
<br>
Can someone post to full-disclosure a price list of what they think a<br>
bufferoverflow should be worth etc, and we can vote if we agree.<br>
<br>
So what i'm calling for is someone to post up a hackers price list per<br>
vulnerability type.<br>
<br>
XSS/SQL should be worth something as well, so Morning_Wood can buy<br>
milk and a news paper in the mornings after he's taken care of his<br>
wood.<br>
<br>
Sorry i've ended this e-mail with slightly off-topicness, but I do<br>
think pricing needs to be defined.<br>
<br>
We can't dress up cash prizes/contests as something else as well, if a<br>
website is offering a $5,000 reward for a vulnerability, we need to<br>
know if we're being ripped off with the cash reward and how much can<br>
be potentially made after its sold on.<br>
<br>
Robert Lemos even <a href="http://www.securityfocus.com/news/11510" target="_blank">http://www.securityfocus.com/news/11510</a> talked about<br>
vulnerability pricing when Pwn2Own was on, and even Pwn2Own cash<br>
reward might not be enough money, compared to what a vulnerability<br>
*should* be worth, and taking into consideration how much profit<br>
CanSecWest make overall from people attending the conference.<br>
<br>
So you take into consideration how much a vulnerability should be<br>
worth, then the added worth because its a security conference of how<br>
much should be added on to counter the profit being made by the event.<br>
<br>
A vulnerability should be worth more if its disclosed at a security<br>
conference than if its bought privately, because you've got to take in<br>
profit and free advertsing to calculate.<br>
<br>
However, to round off, we can't allow the mailing lists to turn into a<br>
vulnerability market place, full-disclosure should be for free stuff,<br>
and other websites and mailing lists can be setup for *money making<br>
schemes and auctions*.<br>
<br>
We shouldn't allow the money makers directly to market X... if a link<br>
is put on Full-Disclosure by a member of the public on the fly then<br>
thats ok, but I think its cheeky for the particular conference,<br>
contest runner or software trainer to be on the list themselves<br>
spamming everyone, for a profiteering agenda.<br>
<br>
You mention cross-posting, thats not the issue here, its the people<br>
making the money posting to make the money that offends me so much.<br>
<br>
And not even the lonely hacker offends me who posts i've got a<br>
vulnerability for sale for X, I don't mind that on Full-Disclosure,<br>
but what I do mind is if its a company or organisation doing it that<br>
is directly the ones making the money via vulnerability for sale,<br>
prize contest, security conference or train to use our software!!!,<br>
thats the height of spam I just think is utterly wrong and unethical<br>
on any scale of acceptability.<br>
<br>
If a lonley hacker who works in a supermarket has a vulnerabilty to<br>
sell i'm all for it being post on full-disclosure, but not the big<br>
money conferences, prize hacking contests and software training guys.<br>
<br>
I come under the bracket as supermarket worker with nothing much going<br>
for me in life, so I should be allowed to sell a vulnerability on<br>
what's ment to be a mailing list for non-profit disclosure.<br>
<br>
If we tolerate the money making schemes much longer, eventually<br>
full-disclosure will be a wash with conference,training,cash prize<br>
spam, etc once everyone realises the full value of vulnerabilities and<br>
the huge amounts of money to be made from setting up a cash prize<br>
contest, the huge amounts of money to be made from setting up a<br>
security conference and the huge amounts of money to be made from<br>
training people to use your hax0r software.<br>
<br>
You will find it easy to shout me down and say n3td3v's an idiot, but<br>
wait to the vulnerability market really takes off and the prices of<br>
vulnerabilities are properly defined and regulated, you're going to<br>
see a huge increase in commercial spam on the mailing lists, like the<br>
full-disclosure mailing list. so we've got to define what's fair play<br>
e-mail and what's a company or organisation blatantly profiteering<br>
with X method of extracting money out of people and using skilled<br>
hackers to make money, and to promote a security conference, training<br>
etc.<br>
<br>
All the best,<br>
<font color="#888888"><br>
n3td3v<br>
</font></blockquote></div><br></div>