Full-disclosure – Administrivia: The End
Instrumental in this message for me was this part:
There is no honour amongst hackers any more.
10-20 years back a term hacker had a close relation to a certain moral conduct emphasizing freedom of knowledge. Today with a mass market of startups, that was largely popularized by Hacker News, this perception has changed. A hacker now is a founder. He must be good at raising money, monetizing a product and the greatest feat of all - exit. There's no more moral obligations of the past. Launch at all cost - the rest is an afterthought.
There's a discrepancy between the two cultures. I think this divide is the source of the mailing-list problem and problems with freedom of information and privacy at large we have today.
A bit of context, maybe it will be helpful for some:
http://seclists.org/fulldisclosure/2014/Mar/170
http://seclists.org/fulldisclosure/2014/Mar/294
http://seclists.org/fulldisclosure/2014/Mar/291
http://seclists.org/fulldisclosure/2014/Mar/286
http://seclists.org/fulldisclosure/2014/Mar/298
And a full email exchange: http://seclists.org/fulldisclosure/2014/Mar/index.html#123
My personal favourite (in a positive way): http://seclists.org/fulldisclosure/2014/Mar/160
It seems ironic for the end to arrive without full disclosure of why.
Can someone from the security community explain exactly what the list is? Is it a mailing list where researchers disclose exploits that have been found (after doing their best to responsibly notify the developers of the effected systems)?
Sites that allow anonymous postings through tor (e.g. reddit) are the last remaining voice of freedom on the Internet.
It is unfortunate that HN is not numbered among those sites.
Edit: I was incorrect about HN. See the comment below. I am happy to learn that I was wrong.
What a shame; I just recently started taking on an interest in computer security and signed up for the list. In just the few weeks I was on there, I learned about a vulnerability in a device I had recently bought. I am cherishing the opportunity (which I haven't found time for yet) to walk through my first exploit!
As a newcomer I'm not really sure what John's referring to, though. Too bad...
He doesn't disclose much information, but it looks a bit like he (sourly) blames the industry and community for something that is very common elsewhere too: to run a public forum or mailing list, you now need not only the users' support and goodwill, but also legal counsel, a thick skin and willingness to challenge legal threats, as well as all sorts of technical means to fend of malicious activities (DoS/spam protection etc.).
What's stopping such communities from going "underground", i.e. to some darknet where anonymity and protection from some of these hassles still exists?
"He who foresees calamities, suffers them twice over"
Wow, this is sad. Hope we can get more info on what was going on.
Besides Bugtraq what mailing lists security wise do you follow?
EDIT: Or what other general means by Twitter, Websites, Databases, Blogs etc. do you recommend?
First thing I saw in my inbox when I got to work this morning. Sad really, the list has certainly had it's moments.
Can't help but be a little optimistic, at least the "Google Vulnerability with PoC" youtube-upload trollfest chain of emails is done flooding my inbox this month :D
undefined
"... an industry that never should have become an industry."
What are some other similar lists to follow?
Today is a sad day. I wonder what will replace full-disclosure as the de-facto vehicle to announce vulnerabilities.
Would anyone mind explaining to me as a noob what kind of legal challenges public lists need to defend against these days?
Spam, trolls and politics are not new, but legal threats and DoS attacks I didn't expect to be problems.
Sad :( This was my favorite mailing list for the past decade or so, although it's been in decline for years.
Really was a great list, one of my favorite. I will miss it, sincerely.
He didn't really explain the full problem so maybe I am not fully appreciating the situation here, but this seems like a pretty big overreaction for a stupid request from some a single user.
What exactly happened?
It seems ironic for the end to arrive without full disclosure of why.