Thursday, July 28, 2005

Responsible Disclosure

In an email conversation today on the this interesting article:

LAS VEGAS – The annual Black Hat computer-security conference has become a forum for experts to disclose vulnerabilities in tech products, often rankling the products' makers. But few companies go to the lengths that Cisco Systems Inc. did this week to suppress information about a flaw in its software that directs Internet traffic.
Cisco threatened legal action to stop the conference's organizers from allowing a 24-year-old researcher for a rival tech firm to discuss how he says hackers could seize control of Cisco's Internet routers, which dominate the market. Cisco also instructed workers to tear 20 pages outlining the presentation from the conference program and ordered 2,000 CDs containing the presentation destroyed.
In the end, the researcher, Michael Lynn, went ahead with a presentation, describing flaws in Cisco's software that he said could allow hackers to take over corporate and government networks and the Internet, intercepting and misdirecting data communications. Mr. Lynn, wearing a white hat emblazoned with the word "Good," spoke after quitting his job at
Internet Security Systems Inc. Wednesday. Mr. Lynn said he resigned because ISS executives had insisted he strike key portions of his presentation.

XXX: It's irresponsible! Like yelling fire in a movie theatre or [...]
Mark: or "Jihad" in a crowded mosque...

No comments: