Slashdot Mirror
Full-Disclosure Security List Suspended Indefinitely
An anonymous reader writes with news that John Cartwright has been forced to shut down the full disclosure list. The list was created in 2002 in response to the perception that Bugtraq was too heavily moderated, allowing security issues to remain unpublished and unpatched for too long. Quoting: "When Len and I created the Full-Disclosure list way back in July 2002, we knew that we'd have our fair share of legal troubles along the way. We were right. To date we've had all sorts of requests to delete things, requests not to delete things, and a variety of legal threats both valid or otherwise. However, I always assumed that the turning point would be a sweeping request for large-scale deletion of information that some vendor or other had taken exception to.
I never imagined that request might come from a researcher within the 'community' itself (and I use that word loosely in modern times). But today, having spent a fair amount of time dealing with complaints from a particular individual (who shall remain nameless) I realised that I'm done. The list has had its fair share of trolling, flooding, furry porn, fake exploits and DoS attacks over the years, but none of those things really affected the integrity of the list itself. However, taking a virtual hatchet to the list archives on the whim of an individual just doesn't feel right. That 'one of our own' would undermine the efforts of the last 12 years is really the straw that broke the camel's back.
I'm not willing to fight this fight any longer. It's getting harder to operate an open forum in today's legal climate, let alone a security-related one. There is no honour amongst hackers any more. There is no real community. There is precious little skill. The entire security game is becoming more and more regulated. This is all a sign of things to come, and a reflection on the sad state of an industry that should never have become an industry.
I'm suspending service indefinitely. Thanks for playing." The archives are still up on seclists.org, gmane, and Mail Archive. For now at least.
I never imagined that request might come from a researcher within the 'community' itself (and I use that word loosely in modern times). But today, having spent a fair amount of time dealing with complaints from a particular individual (who shall remain nameless) I realised that I'm done. The list has had its fair share of trolling, flooding, furry porn, fake exploits and DoS attacks over the years, but none of those things really affected the integrity of the list itself. However, taking a virtual hatchet to the list archives on the whim of an individual just doesn't feel right. That 'one of our own' would undermine the efforts of the last 12 years is really the straw that broke the camel's back.
I'm not willing to fight this fight any longer. It's getting harder to operate an open forum in today's legal climate, let alone a security-related one. There is no honour amongst hackers any more. There is no real community. There is precious little skill. The entire security game is becoming more and more regulated. This is all a sign of things to come, and a reflection on the sad state of an industry that should never have become an industry.
I'm suspending service indefinitely. Thanks for playing." The archives are still up on seclists.org, gmane, and Mail Archive. For now at least.
Come on then, let's have full disclosure. WHO made the threats?
I think the changes brewing in the wake of Target breach and Snowden's leak show the power of full disclosure. It seemed to me that "responsible disclosure" was just another way of saying "no consequences." And we see time and time again how no consequences equals no action.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Nor would health & safety, auditing, repair shops, replacement parts, the guy who checks the pitot tube on aircraft is clean, etc. nor countless thousands of other industries. The fact that the industry exists shows you that a) we cannot secure things perfectly but b) we try hard to do so.
Fact is, you cannot make a secure product, no matter how cocky you are. So you need experts to secure things, whether or not they are forced to do so on sub-standard operating systems, hardware or applications.
Personally, I think we've come on leaps and bounds in terms of OS security in the time I've been around, but it's application security that's the problem - and the biggest problem comes from OS's not being "allowed" to lock down applications to their bare minimum necessary resources in the first place.
And now we have a new threat - hardware security where our own machines are being used against us.
It's like saying that if everyone put rubbish in a bin, we wouldn't need street cleaners. Almost true, not quite, but almost. But it's honestly, never, ever, ever going to happen until we are literally redefining "rubbish", "bin" and "cleaner" (i.e. automated robots running around doing it for us).
And real life, as shown here, is much more affected by stupid people, making stupid decisions and even enacting stupid laws. In a perfect world we wouldn't have any of those either. But still we have lawyers.
Name the names. Sorry, I simply don't buy the reasoning at all. If the problems were so bad you want to "stop it all together" then you indicate who that person is.
"I believe in full disclosure! And I'm not going to tell you why I'm doing this!" Fail, fail. Name and shame or fuck off, we have no time for your enabling bullshit. You have served your purpose, and are now useless. Er, not you, you know who I mean.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
As a security guy who has also been on the short end of legal threats too I feel for this guy. He's burned out and could use a year on the beach. Take a year or two at a cushy corporate security job but please keep the list alive - there are plenty of other moderators who would pick up the slack.
There's a meme going around that "Fact is, you cannot make a secure product," is somehow a "Truth" that we all just have to accept.
This is just BS. Of course you can make a secure product. You just have to commit the time and resources to make security your top priority.
If you want to securely control your HVAC systems in your data centre, don't connect it to the Internet: Hire a person to operate it. If you want to securely control your nuclear reactor, don't connect it to the Internet but hire a staff to operate it using air-gapped systems.
If you want to save money on salaries by connecting your critical systems to the Internet using commodity CPUs that don't separate writable RAM from executable RAM, and operating systems designed for single user with poor security built in, and software written by the lowest bidder using languages that encourage lazy programmers to write buffer overruns, then you will save money but there's no way you can make a secure product. But don't pretend it's a universal fact that security is not possible: Recognize it's your own penny-pinching that is causing the problem.
Sometimes the "writing on the wall" is blood spatter...
This is what we were talking about yesterday regarding the github brouhaha . Assholism amongst the dev community appears to be so high that, statistically speaking , the odds of being able to run a site like this one, or say have a decent working atmosphere tends to zero once the company is big enough or the site is popular enough.
For significant public-interest websites, you somehow need a serious source of funding just for maintenance work to counter the effects of assholes. For companies, they're basically pirate ships populated by people who think of themselves as laws unto themselves, as glorious buccaneers . The lesson of git hub and this guy is simple. Software devs are just as bad as anyone in Exxon . They'll drop trou and take a gigantic dump on any aspect of the social contract they want to the moment it suits them.
I am not saying this is in contrast to some golden bygone era of civility. People have always been like this. Well, for a while in software development, before Bill Gates started sending out cease and desist legal notices to people who were copying the software he copied from CPM , there was s kind of golden era perhaps. But then Lucky Autisim Boy started to make real money at Microsoft and then IBM decided to start getting software patents en masse and civility retreated to the borders of academic research . Now it appears that's gone also.
We're not better and we're not going to be the ones to usher in a new way of dealing with our fellow humans. What we know for sure now is that just like our most successful exemplars, Jobs and Gates, we're as exploitative, opportunistic amoral and dehumanizing as the next industry. And that's a little sad.
You know, when you commit a crime and another person is aware of that crime and does nothing, that same person is guilty as well. If theres any legal repercusion to this...
a) They're not guilty of the same crime
b) What crime are you talking about?
systemd is Roko's Basilisk.
Isn't finding out who made the threats. Where can we find the Furry porn?
This quote should concern everyone. We have now had an entire generation of programmers raised on walled garden apps, cookie-cutter scripting libraries, and above all a wave of cheap VC funding and hardware. How many people are left out there that can build the likes of Bittorrent, Bitcoin, a language like C, a game like Elite, or even a site like Slashdot? How many people, young people, are there who can write an OS kernel, design a basic circuit, and at a more pertinently serious level, reliably write software to implement mathematical encryption algorithms.
Reading this I'm inclined to believe that recent meme post about how the programming/silicon valley community has been taken over by "brogrammers", "hipsters" and "neckbeads", which to my mind are simply constitute cultural re-skinnings of the infamous Visual Basic programmers of old.
I worry that the unglamorous, mostly uncompensated, and largely intellectually driven practice of pure software programming and creation has been left behind in recent years. I personally have noticed little progression and indeed in many areas a general regression in the quality and reliability of software since approximately 2006/7.
While I would attribute this to my general "civilization is in decline" zeitgeist worries, my frustrations with software, UIs, and websites in particular has undoubtedly increased manifestly in the last 2-3 years or so. Maybe I'm just getting old -- or maybe programmers really are getting worse.
May the Maths Be with you!
The snakeoil peddlers and smokescreen builders are in full swing. I guess it's the "in the kingdom of the blind, the one eyed is king" thing, where security managers who have no clue hire consultants who have a little bit thereof. I recently handed in my resignation as the CISO of a fairly large logistics giant because I reached the point where I could no longer carry the responsibility, especially for customer data.
I come from a technical background. Not a business one. I'm neither manager nor beancounter by education, though I now have to pose as one. My security "career" started out with malware analysis and reverse engineering. With time, I ended up in management, eventually shifting over to another job and reaching said CISO position, after digging through the depths and pits of security management, process management and IT-management in general. I learned what makes managers tick and why they're so in love with IT-governance tools: They offer a lot of neat business ratios that allow you to pretend you know what your company is doing without even having to understand it.
And this is where the problem starts. Because IT-Consulting companies jumped that bandwagon instantly. Their main selling point today is that they deliver you some of those business ratios. That's what is wanted. Nobody gives a shit whether they know what they're doing or whether they have some key pushing monkeys that can barely decypher the output of Nessus. Because that's what 9 out of 10 consultants we hired (I had to, don't look at me like that!) could do, and little more. Fire up some automated analysis tool and have it sit there, collect data, then compile some neat looking report (i.e. copy/paste the output, then write a summary based on the fill-the-gaps crib sheet).
'scuse me, but I don't need a consultant for a few 100 bucks an hour just to push 3 buttons, and then end up with a "security analysis" that doesn't even find half the problems!
The least I'd expect from a consultant is that he knows more about a subject than I do. Else, well, why have him? Why should I pay him if he should rather consult me than me him?
But they get away with that. For two reasons. First, the average security manager knows even LESS than them. The average security manager is first and foremost a manager, not a technical person. He knows the processes, he knows the procedures, he maybe knows the legal stuff it entails. But lacks the intimate knowledge of the inner workings of networks and computer systems. In such a world led by the blind, the one eyed can easily become their king. And because they know processes, procedures and legal foundation, they also know what leads to problem number two: It doesn't matter. They're safe. They did everything ISO27001 demands, they did everything BS7799 requires, they did everything their governance framework expects, they're safe. Their company isn't, but why should they give a shit? Their job is safe, that's what matters. To them, at least.
And no, I have no idea how to improve that situation. No matter what you change, you're not going to get any better results.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's hardly "full disclosure".
If you can't post it, leak it.