Re: [VulnDiscuss] CERT

-----BEGIN PGP SIGNED MESSAGE-----

Mark,

We are sorry to hear that our disclosure policy caught you by
surprise.  We honestly thought you aware of the policy that has been
publicly available for two years now at:

  <http://www.kb.cert.org/vuls/html/disclosure>

This policy reads in part:

  Q: Who gets the information prior to public disclosure?

  A: Generally, we provide the information to anyone who can
     contribute to the solution and with whom we have a trusted
     relationship, including vendors (often including vendors whose
     products are not vulnerable), community experts, CERT/CC
     sponsors, members of the Internet Security Alliance (including
     private sector organizations), and sites that are part of a
     national critical infrastructure, if we believe those sites to be
     at risk.

In this particular case, no information was disclosed by the CERT/CC
that contradicted this policy.  No information about the
vulnerabilities was prematurely disclosed to the public, and no
information was inappropriately disclosed to additional third parties
by the organizations we told.  We believe that the organizations that
we provided the information to are reliable and trustworthy, and we
have worked very hard over the past fifteen years to develop and
follow reasonable and responsible disclosure policies.

We will continue to value the trusted relationship of our team and
yours.  You have demonstrated time and again your willingness to work
with us and the community at large in helping to protect people from
being hurt by the issues you discover.  If there are issues in the
future that you feel we can help you and the community with, please
let us know.  We welcome the opportunity to work with you.

Sincerely,
Cory
- -- 
======================================================================
Cory Forrest Cohen        [email protected]       CERT Coordination Center
Hotline: +1-412-268-7090                Software Engineering Institute
Fax: +1-412-268-6989                        Carnegie Mellon University
======================================================================


-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
Charset: noconv

iQCVAwUBPjlCGWjtSoHZUTs5AQH16wP8CHHq8GdZYslMxIKOymsw56d+oxsX8KR5
sa6At2IaUzIkPh8NrzMDHV3sYR7SyaxMSRJmRGR53Tm4TfJwuaQRF9HY+516KGll
Htq7ai6Wc8Ki4M17Nz/TLxr9YhULlBmBYdEUC3ccYW+A9UWp7BJa0hg3nVmdQYB6
Zg3OzXqsanc=
=LCt4
-----END PGP SIGNATURE-----