Re[2]: [VulnDiscuss] Cybersecurity, Research & Disclosure Conference

Hey all,

CW> More active independant security researcher participation would help make
CW> the conference better.  I encourage people in this group to either attend
CW> or email Jennifer Granick <[email protected]> about getting a speaker
CW> slot.

Hrm, that is what I'd call an early outreach to the research community
:-) The conference is what, 14 days away ? And the schedule is already
finished. Way to go :)

From what I can see the only relevant researcher on this conference is
David Litchfield, and due to his experience with SQLSlammer I am not
sure he is going to be a big counterpoint to the OIS stance. Even if
he was he'd at least be outnumered 1 to 5.

Perhabs there's so few active independent security researchers because
they are busy actively researching instead of trying to shape an
ethical code governing the right way others should go about their
lives.

Sometimes it seems there's two disjoint groups in security: Those that
find relevant bugs, and those in OIS that do not but want to get paid anyhow
(not 100%ly true, at least ISS has an active and really good research
team)

The OIS disclosure rules have been drawn up in absence of the research
community, mainly because the research community can find bugs instead
of having to argue ethics to justify their existence.

Could someone please step forward and propose a good
market-for-vulnerabilities model ?

Then again, I just woke up and am notoriously grumpy in the morning,
so take this post with a grain of salt.

Cheers,
Halvar