[VIM] Re: [Full-disclosure] Secunia published adviso
withoutrespectingrelease date ! (fwd)
jericho at attrition.org
Sat Jul 16 05:25:02 EDT 2005
---------- Forwarded message ----------
From: Xavier Beaudouin <kiwi at oav.net>
To: Jerome Athias <jerome.athias at free.fr>
Cc: full-disclosure at lists.grok.org.uk
Date: Sat, 16 Jul 2005 11:17:50 +0200
Subject: Re: [Full-disclosure] Secunia published adviso withoutrespectingrelease
Le 16 juil. 05 à 03:59, Jerome Athias a écrit :
> 2 things i remind myself...
> 1) http://seclists.org/lists/vulndiscuss/2004/Dec/0006.html
Yes. I received this one. But I still don't agree that Secunia didn't take the
time to inform The Caudium Group *before* sending this "advisory" to security
This is _not_ fair and positivement a bad way to be *respected* on security
This also the reason why we decided (we = caudium group) to close bug tracker
at sourceforge to avoid false information to be sent.
Usualy the idea is :
bug/security problems found -> draft of advisory is sent to developpers to get
more accurate information -> time to make a fix -> advisory is sent
Secunia has just taken a bug from our tracker *without* telling the Caudium
Group that are taking this for makeing a advisory, and just sent it to security
lists with _false_ information.
I still consider that this is half done work and they are not nice people when
they make advisory.
So because of that half done work, all Caudium Group developpers now don't
trust anymore Secunia. I am sorry for them, but this is the way they make the
advisory without contacting authors that give us this situation.
> 2) This is an answer of Thomas before a disclosure of some vuln that Secunia
> found "at the same time" :
> 10/09/2004 19:40
> Re: OpenOffice World-Readable Temporary Files Disclose Files to Local Users
> Hi Jérôme,
> This issue was originally discovered by Secunia on 16th August and
> reported to the vendors.
> Please do not forward to anyone else. The various vendors well release
> updates on Wednesday in a co-ordinated disclosure.
> Kind regards,
They didn't get so smarter with us. We still don't accept this fact.
If they where so smart we still trust them. They were not so they are
their own victim of their half work for Caudium group advisory.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
More information about the VIM