Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Vulnerabilities in *McAfee.com
From: Jeffrey Walton <noloader () gmail com>
Date: Wed, 30 Mar 2011 17:28:59 -0400

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor () hammerofgod com> wrote:
I have that very strip printed and on the wall in my office :)    You make several points, but the response that 
immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding 
vulnerabilities, and entering data in a search box.  I don't know if there is any basis for this legally, but I feel 
that if you put a box up and I can search for something, then I can put whatever I want in that box.  You (the royal 
you) are basically soliciting people to put data in the box.   However, you are not asking anyone to spider your site 
or run scans against it.

If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]