On Fri, 24 Mar 2006, Gadi Evron wrote:
On Thu, 23 Mar 2006, Claus Assmann wrote:It took Sendmail a mounth to fix this. A mounth.No. It took sendmail a week to fix this. The rest of the time was used to coordinate the release with all the involved vendors etc.There are a few choices, full disclosure and "responsible disclosure" are some. You can't do both. Releasing it out of nowhere, obfuscated in very ineffective way, isn't it. Not when it's critical infrastructure. With critical internet infrastructure you need to be a tad bit smarter than that.
How would you suggest that they release this? I think that they did it in a pretty responsible way. They where notified of the problem, they fixed it and gave vendors who use/ship the product some time to create and test patches, then it became public. This was done in a month, any longer and I would think that they would be putting us at risk, but I think that this is a very reasonable response. 0Day full-disclosure eith a 'sploit would have been more trouble for me ;-) (I'm probably not alone with that). Todd