Fredrick Diggle security would like to thank Dan Kaminsky for his new methodology for vulnerability disclosure. The Dan Kaminsky Method consists of the following steps.
1. Think of technology or protocol that has high exposure throughout the internets 2. Contact all of the vendors and tell them to patch all of the BADNESS in the standards which has been known about for 15 years. 3. Contact lots of media outlets with lots of readers but no technical skill (http://blogs.zdnet.com/security/?p=1468 <- Nate is good at being clueless) and have them write doomsday stories about the end of the internets. 4. Publicly disclose an 'undisclosed' vulnerability in said technology. It is critical that you make a HUGE deal out of telling smart people that they should NOT speculate as to the nature of the vulnerability as it would threaten the entire internets. On the side tell people that you will give them partial credit if they find 'your' vulnerability before the public disclosure in a year or so. 5. Wait for someone smart to find a real vulnerability and then act all pissed that they talked about it before you. 6. Have a popular blogger with questionable morals 'accidentally' leak the full technical details of the vulnerability. 7. ??? 8. PROFIT!!!! ========================================================== As a supplement to this, Fredrick Diggle security would like to disclose a critical vulnerability in the Windows IPv4 network stack. This vulnerability is trivially remotely exploitable and could doom the entire internets if disclosed prior to being patched. All vendors have been notified and are working on patches. Fredrick Diggle will disclose the details of this vulnerability once he is sure that everyone is immunized (at Blackhat security conference in 2015). He would like to make it very clear that people should not speculate as to the nature of this vulnerability as public disclosure could threaten the entire infrastructure of the world (Halvar, This means you!). Anyone who independently discovers this vulnerability prior to public disclosure will be invited on stage to be recognized as having found it second. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/