<story><title>IPv6 Attack Kills Mac OS X and makes Windows Server 2012 restart in Seconds</title><url>http://samsclass.info/ipv6/proj/RA_flood2.htm#1</url><text></text></story><parent_chain><item><author>ghshephard</author><text>Disclosure to Apple - Apple notified 12-11-12.&lt;p&gt;I often wonder why disclosures of these types of exploits is now, &quot;same day&quot; instead of &quot;Let vendor know you will be reporting this to public in a week.&quot;&lt;p&gt;I wonder if it is out of concern they will be pressured to keep quiet?&lt;p&gt;There is a good practical reason for not providing advance disclosure at major conference, particularly if you&apos;re subject to some kind of NDA, because, more often then not, the security researcher faces the risk of legal action and being shut down.&lt;p&gt;That pattern, though, &quot;We are going to announce a security hole in major vendor product&quot; followed by, &quot;Shut down by legal action&quot; - happens so frequently that I often wonder whether that&apos;s actually part of some larger pattern of entrepreneurial behavior that&apos;s opaque to me, it happens so frequently.  Maybe it enhances your reputation?  Gets you in the news?&lt;p&gt;I&apos;m all for full disclosure, but, it might be nice to give the vendor a week to have a patch that can roll out at the same time as you let the world know what you found.</text></item></parent_chain><comment><author>splicer</author><text>When I discovered a vulnerability in Mac OS X that would allow a unprivileged user to keylog every user on the system (CVE-2007-0724), I let Apple know, then kept quiet until they fixed the issue. It took them 11 and a half months to fix. They thanked me in the security update note, and I now how a CVE on my resume. Was silence the most morally correct action? To this day, I am still unsure.</text></comment>
<story><title>IPv6 Attack Kills Mac OS X and makes Windows Server 2012 restart in Seconds</title><url>http://samsclass.info/ipv6/proj/RA_flood2.htm#1</url><text></text></story><parent_chain><item><author>ghshephard</author><text>Disclosure to Apple - Apple notified 12-11-12.&lt;p&gt;I often wonder why disclosures of these types of exploits is now, &quot;same day&quot; instead of &quot;Let vendor know you will be reporting this to public in a week.&quot;&lt;p&gt;I wonder if it is out of concern they will be pressured to keep quiet?&lt;p&gt;There is a good practical reason for not providing advance disclosure at major conference, particularly if you&apos;re subject to some kind of NDA, because, more often then not, the security researcher faces the risk of legal action and being shut down.&lt;p&gt;That pattern, though, &quot;We are going to announce a security hole in major vendor product&quot; followed by, &quot;Shut down by legal action&quot; - happens so frequently that I often wonder whether that&apos;s actually part of some larger pattern of entrepreneurial behavior that&apos;s opaque to me, it happens so frequently.  Maybe it enhances your reputation?  Gets you in the news?&lt;p&gt;I&apos;m all for full disclosure, but, it might be nice to give the vendor a week to have a patch that can roll out at the same time as you let the world know what you found.</text></item></parent_chain><comment><author>pixl97</author><text>&lt;a href=&quot;http://blogs.computerworld.com/mac_os_x_java_fiasco_apple_still_doesnt_get_security&quot; rel=&quot;nofollow&quot;&gt;http://blogs.computerworld.com/mac_os_x_java_fiasco_apple_st...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http://www.the4cast.com/apple/apples-flashback-fiasco-what-really-happened/&quot; rel=&quot;nofollow&quot;&gt;http://www.the4cast.com/apple/apples-flashback-fiasco-what-r...&lt;/a&gt;&lt;p&gt;2 years apart, same outcome. Apple has a terrible track record of fixing bugs. As of so far it seems giving them a minute, week, or month has no difference. In the past other vendors have had issues with timely fixing their bugs or trying to squash disclosers, that&apos;s why lists like full disclosure exist to this day.</text></comment>