Gryph wrote:
Hey all (long time no see)

Followed thread about Lavasoft beta threat detector. Seems Lavasoft has a
problem with full disclosure in respect to software vulnerabilties.
Perhaps a Lavasoft rep could clarify this. The 'entire' security industry
covers a wide area:

they were recently bitten by an article appearing on rootkitDTcom about
vulnerabilities in their software quite probably the person involved
didn't follow responsible disclosure

addressing their concerns to the entire security industry is reasonable
as there is a fairly large segment of self-proclaimed whitehats who
release information more as a way to put a notch in their belts than as
a way to close various windows of exposure, and a big chunk of the rest
of them don't care enough to call the first group on their self-serving
behaviour

Art wrote:
Mon, 24 Apr 2006 00:10:19 -0400, kurt wismer <kurtw@sympatico.ca>
>Gryph wrote:
Hey all (long time no see)

Followed thread about Lavasoft beta threat detector. Seems Lavasoft has a
problem with full disclosure in respect to software vulnerabilties.
Perhaps a Lavasoft rep could clarify this. The 'entire' security industry
covers a wide area:
>they were recently bitten by an article appearing on rootkitDTcom about
>vulnerabilities in their software quite probably the person involved
>didn't follow responsible disclosure
>>
>addressing their concerns to the entire security industry is reasonable
>as there is a fairly large segment of self-proclaimed whitehats who
>release information more as a way to put a notch in their belts than as
>a way to close various windows of exposure, and a big chunk of the rest
>of them don't care enough to call the first group on their self-serving
>behaviour
>
The following rootkit.com forum link to a Ad-Aware critique may be
what inflamed the Ad-Aware developers:

[snip]

and here's the followup concerning their Beta fix:

[snip]

There's no indication that the author contacted Lavasoft with his list
of weaknesses before posting, and it seems odd that he would choose
that particular forum to to air his findings. His postings do have the
appearance of someone trying to make a reputation for himself, and not
behaving in a professional manner. However, it doesn't seem to me that
Lavasoft is handling the situation in a professional manner either.

that's a mater of opinion, i suppose i don't see anything
unprofessional in pointing out the author of the critique is being part
of the problem rather than part of the solution

[snip
What strkes me about the critique is that vulnerabilites (as I would
intepret the term) are not the issue. Rather, the critique concerns
itself mostly with alleged security weaknessness things that
could, in the opinion of the author, be done in a more secure manner.
It seems to me that Lavasoft should have quietly made whatever
improvements to security they believe are warranted, rather than
engaging in a general public condemnation of the behaviour of some
individuals who seem to be more self-serving than objective.

sorry, i can't agree if they had been contacted quietly about the
problems then i would have expected them to quietly fix them, however i
see no reason why they should be quiet when someone is trying to make a
name for themselves at the expense of lavasoft *and* all it's users

the name of the game is supposed to be improving security - to that end
the goal should be the closure of whatever windows of exposure that
exist for the various vulnerabilities public disclosure has the
effect of maximizing risk for those vulnerabilities and is essentially a
means of using *force* to try and get the vulnerabilities fixed such
practices should a last resort but more and more self-proclaimed white
hats aren't even bothering to attempt going through other channels
first they're recklessly increasing risk when they don't need to and
those who wind up being their victims have every right to complain

i have every confidence that lavasoft is working to correct the
problems, but just because they have problems with their software
doesn't mean they should bend over and take it up the arse from every
tom, ****, and harry who wants to make a name for themselves