Re: [Full-disclosure] Vulnerabilities in *McAfee.com

[Jeffrey Walton <noloader@xxxxxxxxx>]

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor@xxxxxxxxxxxxxxx> wrote:
> I have that very strip printed and on the wall in my office :)    You make 
> several points, but the response that immediately comes to mind is that I 
> actually see a difference between actively scanning content for 
> structural/coding vulnerabilities, and entering data in a search box.  I 
> don't know if there is any basis for this legally, but I feel that if you put 
> a box up and I can search for something, then I can put whatever I want in 
> that box.  You (the royal you) are basically soliciting people to put data in 
> the box.   However, you are not asking anyone to spider your site or run 
> scans against it.
>
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/