Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-25 Thread Kurt Seifried
Please read the list charter and stop posting junk like this. Do we know
post stories about any criminal charges brought against anyone in the
security industry? Should we also cover parking tickets?

Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread gml
But seriously, sex with minors isn't exactly a parking ticket.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kurt Seifried
Sent: Monday, August 25, 2003 6:29 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: Re: [Full-Disclosure] CERT Employee Gets Owned

Please read the list charter and stop posting junk like this. Do we know
post stories about any criminal charges brought against anyone in the
security industry? Should we also cover parking tickets?

Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Peter van den Heuvel
But seriously, sex with minors isn't exactly a parking ticket.
Nor does it have anything to do with security or even computers.

Peter

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Myers, Marvin
As being one who was rightfully chastised by Kurt recently, I do believe
that this could indeed have some relevance to the FD list. If by this
mans actions, his past work could at all be suspect, then this is the
proper venue to post it. If someone of his caliber, someone who should
know the repercussions of any action taken using a computer as a tool,
is used as an expert during trial, or their technical writings used as
such, can we not realistically look at all of his past work as being
suspect. If indeed he is a pedophile, he may have overlooked other
pedophile activity in the course of his job. While I would never accuse
someone whom I do not have personal proof of illegal activity, and after
all he is innocent until proven guilty, I can understand why someone may
want to analyze and or scrutinize his past work.

Just my 2cents worth. 

-Original Message-
From: Kurt Seifried [mailto:[EMAIL PROTECTED] 
Sent: Monday, August 25, 2003 6:29 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: Re: [Full-Disclosure] CERT Employee Gets Owned

Please read the list charter and stop posting junk like this. Do we know
post stories about any criminal charges brought against anyone in the
security industry? Should we also cover parking tickets?

Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Peter van den Heuvel
> I can understand why someone may
want to analyze and or scrutinize his past work.
Just because someone likes to be poked in the butt, seduce married 
persons, go to hookers, get pregnant unmarried, fuck a dog or fell for a 
minor? All of which are illegal in large parts of the world.

Just my 2cents worth.
Probably not even that.

Peter

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread henry j. mason
i was going to reply off the list, to cut down the nonsense,
but i'm going to address the issue of morality and it's
relevance to computer security, and then i'm going to shut
up. and, for the record, i think the original post *was* OT.
pedophilia has NOTHING to do with security. it's a morality
issue... what if the person accused was guilty of fraud,
extortion, or tax evasion? we don't know if he was, but
would that put his past work under suspicion?
	possibly.

the fact is, it's almost impossible to know if someone is
going to act in the best interests of others, which is what
is necessary for good computer security. in this case we have
a computer security professional whose responsibilites lay
mostly in communication with the industry, accused of attempting
to satisfy an apparent perversion - in a case that has very
strong overtones of entrapment.
i think the only thing that relates to computer security here
is the issue of trust. the JAP people broke the trust of their
user community by maintaining the appearance of complete
security when in fact that security had been compromised. the
CERT employee in question damaged the trust of his employer
(and apparently those in the security community who are more
concerned about his sexual preferences than his privacy) by
*attempting* to engage in a morally questionable act.

trust is VERY important to computer security. who can you trust?
the goverment? the police? the people on this mailing list?
trust is a complicated thing. i have a commitment to my clients
that requires me to act in their best interests and keep their
data secure. does this mean that my personal life is squeaky
clean? i don't think so. but i have a moral obligation to
ensure the safety and security of my clients, and i don't
confuse that with the morality of my personal life. am i a good
person? i'd like to think so, although any hardcore right-wing
christian would be terrified of my ideals.
	the real question is: am i a good administrator?

	henry

also: i'd *really* rather read about soap opera stuff on /.

Myers, Marvin wrote:
As being one who was rightfully chastised by Kurt recently, I do believe
that this could indeed have some relevance to the FD list. If by this
mans actions, his past work could at all be suspect, then this is the
proper venue to post it. If someone of his caliber, someone who should
know the repercussions of any action taken using a computer as a tool,
is used as an expert during trial, or their technical writings used as
such, can we not realistically look at all of his past work as being
suspect. If indeed he is a pedophile, he may have overlooked other
pedophile activity in the course of his job. While I would never accuse
someone whom I do not have personal proof of illegal activity, and after
all he is innocent until proven guilty, I can understand why someone may
want to analyze and or scrutinize his past work.
Just my 2cents worth. 

-Original Message-
From: Kurt Seifried [mailto:[EMAIL PROTECTED] 
Sent: Monday, August 25, 2003 6:29 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: Re: [Full-Disclosure] CERT Employee Gets Owned

Please read the list charter and stop posting junk like this. Do we know
post stories about any criminal charges brought against anyone in the
security industry? Should we also cover parking tickets?
Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Schmehl, Paul L
> -Original Message-
> From: Myers, Marvin [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, August 26, 2003 7:16 AM
> To: Kurt Seifried; [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] CERT Employee Gets Owned
> 
> 
> As being one who was rightfully chastised by Kurt recently, I 
> do believe that this could indeed have some relevance to the 
> FD list. If by this mans actions, his past work could at all 
> be suspect, then this is the proper venue to post it. If 
> someone of his caliber, someone who should know the 

This is like the SCADA threads.  Nothing but the purest and rankest
speculation.  Why humans feel compelled to speculate about things of
which they know *no* facts or details is beyond me, but ISTM if you just
cannot stop yourself from speculating about it, the least you could do
is have respect for the members of this list and do your speculation
elsewhere.

Here it serves no useful purpose whatsoever.  (And yes, I know how to
filter, so shut up.)

Paul Schmehl ([EMAIL PROTECTED])
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Nelson
I disagree, pedophilia is about security, because we have to know how the users
are using the network. It's about Security Policy.

Imagine what can happen if FBI find naked kids' pictures in one of your
company's computer.

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of henry j.
> mason
> Sent: Tuesday, August 26, 2003 10:06 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Full-Disclosure] CERT Employee Gets Owned
>
>
>   i was going to reply off the list, to cut down the nonsense,
>   but i'm going to address the issue of morality and it's
>   relevance to computer security, and then i'm going to shut
>   up. and, for the record, i think the original post *was* OT.
>
>   pedophilia has NOTHING to do with security. it's a morality
>   issue... what if the person accused was guilty of fraud,
>   extortion, or tax evasion? we don't know if he was, but
>   would that put his past work under suspicion?
>
>   possibly.
>
>   the fact is, it's almost impossible to know if someone is
>   going to act in the best interests of others, which is what
>   is necessary for good computer security. in this case we have
>   a computer security professional whose responsibilites lay
>   mostly in communication with the industry, accused of attempting
>   to satisfy an apparent perversion - in a case that has very
>   strong overtones of entrapment.
>
>   i think the only thing that relates to computer security here
>   is the issue of trust. the JAP people broke the trust of their
>   user community by maintaining the appearance of complete
>   security when in fact that security had been compromised. the
>   CERT employee in question damaged the trust of his employer
>   (and apparently those in the security community who are more
>   concerned about his sexual preferences than his privacy) by
>   *attempting* to engage in a morally questionable act.
>
>   trust is VERY important to computer security. who can you trust?
>   the goverment? the police? the people on this mailing list?
>
>   trust is a complicated thing. i have a commitment to my clients
>   that requires me to act in their best interests and keep their
>   data secure. does this mean that my personal life is squeaky
>   clean? i don't think so. but i have a moral obligation to
>   ensure the safety and security of my clients, and i don't
>   confuse that with the morality of my personal life. am i a good
>   person? i'd like to think so, although any hardcore right-wing
>   christian would be terrified of my ideals.
>
>   the real question is: am i a good administrator?
>
>   henry
>
>   also: i'd *really* rather read about soap opera stuff on /.
>
>
> Myers, Marvin wrote:
> > As being one who was rightfully chastised by Kurt recently, I do believe
> > that this could indeed have some relevance to the FD list. If by this
> > mans actions, his past work could at all be suspect, then this is the
> > proper venue to post it. If someone of his caliber, someone who should
> > know the repercussions of any action taken using a computer as a tool,
> > is used as an expert during trial, or their technical writings used as
> > such, can we not realistically look at all of his past work as being
> > suspect. If indeed he is a pedophile, he may have overlooked other
> > pedophile activity in the course of his job. While I would never accuse
> > someone whom I do not have personal proof of illegal activity, and after
> > all he is innocent until proven guilty, I can understand why someone may
> > want to analyze and or scrutinize his past work.
> >
> > Just my 2cents worth.
> >
> > -Original Message-
> > From: Kurt Seifried [mailto:[EMAIL PROTECTED]
> > Sent: Monday, August 25, 2003 6:29 PM
> > To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> > Subject: Re: [Full-Disclosure] CERT Employee Gets Owned
> >
> > Please read the list charter and stop posting junk like this. Do we know
> > post stories about any criminal charges brought against anyone in the
> > security industry? Should we also cover parking tickets?
> >
> > Kurt Seifried, [EMAIL PROTECTED]
> > A15B BEE5 B391 B9AD B0EF
> > AEB0 AD63 0B4E AD56 E574
> > http://seifried.org/security/
> >
> >
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Elvedin
Please children/40 year old women, stop gossiping. This has nothing to do
with Full-Disclosure or computer security in any way. Pedophilia has NOTHING
to do with security, weirdo. If you want this topic to die, please stop
replying to it. All I know, anybody who replies to this will go on my block
list, this is just as good as spam.

- Original Message -
From: "Nelson" <[EMAIL PROTECTED]>
To: "henry j. mason" <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Tuesday, August 26, 2003 10:21 AM
Subject: RE: [Full-Disclosure] CERT Employee Gets Owned


> I disagree, pedophilia is about security, because we have to know how the
users
> are using the network. It's about Security Policy.
>
> Imagine what can happen if FBI find naked kids' pictures in one of your
> company's computer.
>


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Brad Bemis
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

> Nor does it have anything to do with security or even computers.

There is one issue that does relate.  The announcement said that his work
computer was also seized.  That opens questions of what he was being able
to do with his work system, how can other organizations address similar
issues, what other content was stored on his work computer, was there
anything that relates to current security vulnerabilities that are being
worked on with product vendors, how does this impact those vendors and
issues of confidentiality, what else was he using his work computer for...
etc.  These types of issues DO relate to security. 

Thank you for your time and attention,

===
Brad Bemis
===



-BEGIN PGP SIGNATURE-

iQA/AwUBP0uB15DnOfS48mrdEQK5YQCeMZ/9sGVuV6A/4no3WTK8/Nm0WJoAoIzQ
b6LL/jphZMn/NkPcM204BnzO
=cydG
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Myers, Marvin
That was my entire point, If his supposed breach in morality did or
could have possibly caused a breach at CERT or at any location where he
was at, then it is a security issue.


And as to Pauls remarks, I have more knowledge and first hand experience
about the evils of pedophilia and it's victims than you could ever hope
to gather. This time and maybe only this time I did speak from a
position of experience.


-Original Message-
From: Nelson [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, August 26, 2003 11:21 AM
To: henry j. mason; [EMAIL PROTECTED]
Subject: RE: [Full-Disclosure] CERT Employee Gets Owned

I disagree, pedophilia is about security, because we have to know how
the users
are using the network. It's about Security Policy.

Imagine what can happen if FBI find naked kids' pictures in one of your
company's computer.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Shanphen Dawa
On Tue, 26 Aug 2003 10:49:38 -0500
"Elvedin" <[EMAIL PROTECTED]> wrote:

> If you want this topic to die, please stop
> replying to it. All I know, anybody who replies to this will go on my > block list, 
> this is just as good as spam.

Practice what you preech, why did you reply then?

As for going on your spam list, how is that suppose to be a valid threat? Like anyone 
cares..

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Schmehl, Paul L
> -Original Message-
> From: Myers, Marvin [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, August 26, 2003 11:16 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] CERT Employee Gets Owned
> 
> And as to Pauls remarks, I have more knowledge and first hand 
> experience about the evils of pedophilia and it's victims 
> than you could ever hope to gather. This time and maybe only 
> this time I did speak from a position of experience.
> 
You have *zero* knowledge about *this* incident.  And *that* was my
point.  It's bad enough that the damn news media speculates about
everything under the sun these days.  Why do *we* have to?  What the
hell is the point of speculating about all the various possibilities
tied to an incident of which every one of us is ignorant?  You may have
extensive knowledge of pedophilia, but do you know *anything* other than
what you've read in the news (and surely you don't buy that hook, line
and sinker, do you?)

Obviously nothing is going to stop people from doing that speculating on
the list, so I won't say any more about it, but I beg of the members of
this list.  If you have any human decency at all, *stop* all the rampant
speculation about events of which you know nothing.  All you do is waste
bandwidth.  The facts will come out soon enough, and then you can eat up
the bandwidth discussing the facts, rather than speculation.

Paul Schmehl ([EMAIL PROTECTED])
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Nelson
> You have *zero* knowledge about *this* incident.  And *that* was my
> point.  It's bad enough that the damn news media speculates about
> everything under the sun these days.  Why do *we* have to?  What the
> hell is the point of speculating about all the various possibilities
> tied to an incident of which every one of us is ignorant?  You may have
> extensive knowledge of pedophilia, but do you know *anything* other than
> what you've read in the news (and surely you don't buy that hook, line
> and sinker, do you?)

The media always speculates about security, as we ever see when a teenager
releases a WORM.

So, what can we do? Can't we talk about anything that goes to the media?

PLEASE, STOP THE DIGITAL MASTURBATION AND OPEN YOUR EYES. IT'S ABOUT SECURITY,
IT'S A BIG ISSUE, CAUSE IT'S ABOUT CERT.

PS: Is he a friend of yours?

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-27 Thread Michael D Schleif
Nelson <[EMAIL PROTECTED]> [2003:08:26:15:32:27-0300] scribed:
> > You have *zero* knowledge about *this* incident.  And *that* was my
> > point.  It's bad enough that the damn news media speculates about
> > everything under the sun these days.  Why do *we* have to?  What the
> > hell is the point of speculating about all the various possibilities
> > tied to an incident of which every one of us is ignorant?  You may have
> > extensive knowledge of pedophilia, but do you know *anything* other than
> > what you've read in the news (and surely you don't buy that hook, line
> > and sinker, do you?)
> 
> The media always speculates about security, as we ever see when a teenager
> releases a WORM.
> 
> So, what can we do? Can't we talk about anything that goes to the media?
> 
> PLEASE, STOP THE DIGITAL MASTURBATION AND OPEN YOUR EYES. IT'S ABOUT SECURITY,
> IT'S A BIG ISSUE, CAUSE IT'S ABOUT CERT.
> 
> PS: Is he a friend of yours?

Is there *NO* line?

What if he'd been arrested on _suspicion_ of complicity in a liquor
store robbery?

Or, what if you don't like the way he looks at your girlfriend?

If his current charges -- alone -- are grounds for suspecting his entire
professional life and professional output, where do we draw that line?

-- 
Best Regards,

mds
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--


pgp0.pgp
Description: PGP signature


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-27 Thread Timo Sirainen
On Tue, 2003-08-26 at 18:21, Nelson wrote:
> I disagree, pedophilia is about security, because we have to know how the users
> are using the network. It's about Security Policy.

Sorry for yet another _really_ off-topic post, but this pedophilia talk
got me really annoyed.

Is someone a pedophile just because he had sex with underaged girl?
Underaged meaning against the laws of the country where the it was done?

You know, south africans allow girls to get married at the age of 12. Or
so the web told me. Several other countries had 14-16 age limits. Those
countries must be full of pedophiles!

The age itself doesn't make any difference, it's about if the person is
physically and mentally ready. Of course for most people that's around
14-16 (AFAIK).

I think this case is really stupid. The guy said exactly what he wanted
and didn't lie about his age or anything. Probably he didn't give any
threats or anything like it. Did "she" even say she's not interested
("I'm 15" doesn't count)? At most it's morally questionable if it's
right to keep sending sexual harassment emails, which the receiver could
just delete among the other sex spam she gets.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-27 Thread Justin Shin
umm you guys are all going to hell :)

-- Justin

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Timo
Sirainen
Sent: Tuesday, August 26, 2003 9:26 PM
To: [EMAIL PROTECTED]
Subject: RE: [Full-Disclosure] CERT Employee Gets Owned


On Tue, 2003-08-26 at 18:21, Nelson wrote:
> I disagree, pedophilia is about security, because we have to know how the users
> are using the network. It's about Security Policy.

Sorry for yet another _really_ off-topic post, but this pedophilia talk
got me really annoyed.

Is someone a pedophile just because he had sex with underaged girl?
Underaged meaning against the laws of the country where the it was done?

You know, south africans allow girls to get married at the age of 12. Or
so the web told me. Several other countries had 14-16 age limits. Those
countries must be full of pedophiles!

The age itself doesn't make any difference, it's about if the person is
physically and mentally ready. Of course for most people that's around
14-16 (AFAIK).

I think this case is really stupid. The guy said exactly what he wanted
and didn't lie about his age or anything. Probably he didn't give any
threats or anything like it. Did "she" even say she's not interested
("I'm 15" doesn't count)? At most it's morally questionable if it's
right to keep sending sexual harassment emails, which the receiver could
just delete among the other sex spam she gets.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-27 Thread Steven Alexander
Technically speaking, "pedophile" refers to a person who is sexually
attracted to pre-pubescent kids.  A person who has sex with or is
attracted to someone who is pubescent but underage may be considered
perverse but is not technically a pedophile.

-steven

> -Original Message-
> From: Timo Sirainen [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, August 26, 2003 6:26 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] CERT Employee Gets Owned
> 
> 
> On Tue, 2003-08-26 at 18:21, Nelson wrote:
> > I disagree, pedophilia is about security, because we have 
> to know how 
> > the users are using the network. It's about Security Policy.
> 
> Sorry for yet another _really_ off-topic post, but this 
> pedophilia talk got me really annoyed.
> 
> Is someone a pedophile just because he had sex with underaged 
> girl? Underaged meaning against the laws of the country where 
> the it was done?
> 
> You know, south africans allow girls to get married at the 
> age of 12. Or so the web told me. Several other countries had 
> 14-16 age limits. Those countries must be full of pedophiles!
> 
> The age itself doesn't make any difference, it's about if the 
> person is physically and mentally ready. Of course for most 
> people that's around 14-16 (AFAIK).
> 
> I think this case is really stupid. The guy said exactly what 
> he wanted and didn't lie about his age or anything. Probably 
> he didn't give any threats or anything like it. Did "she" 
> even say she's not interested ("I'm 15" doesn't count)? At 
> most it's morally questionable if it's right to keep sending 
> sexual harassment emails, which the receiver could just 
> delete among the other sex spam she gets.
> 
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - OFFTOPIC

2003-08-26 Thread Kurt Seifried
> But seriously, sex with minors isn't exactly a parking ticket.

But seriously, who cares. This is full-disclosure. Not
"people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
like".

Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - ONTOPIC

2003-08-26 Thread badpack3t
If you dont like it, un-subscribe or quit your bitching.  Instead of
replying with your lame comments making yourself look like a real ass.

-badpack3t

>> But seriously, sex with minors isn't exactly a parking ticket.
>
> But seriously, who cares. This is full-disclosure. Not
> "people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
> like".
>
> Kurt Seifried, [EMAIL PROTECTED]
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - ONTOPIC

2003-08-26 Thread Ron DuFresne

Perhaps you ment to submit a post outlining your rational as to why this
posting was relevant to the list, rather then turning the "bitching"
comments backasswards?

Thanks,

Ron DuFresne

On Mon, 25 Aug 2003, badpack3t wrote:

> If you dont like it, un-subscribe or quit your bitching.  Instead of
> replying with your lame comments making yourself look like a real ass.
>
> -badpack3t
>
> >> But seriously, sex with minors isn't exactly a parking ticket.
> >
> > But seriously, who cares. This is full-disclosure. Not
> > "people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
> > like".
> >
> > Kurt Seifried, [EMAIL PROTECTED]
> > A15B BEE5 B391 B9AD B0EF
> > AEB0 AD63 0B4E AD56 E574
> > http://seifried.org/security/
>
>
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - OFFTOPIC

2003-08-26 Thread Jeremiah Cornelius
Kurt Seifried wrote:

But seriously, sex with minors isn't exactly a parking ticket.
   

But seriously, who cares. This is full-disclosure. Not
"people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
like".
Kurt Seifried, [EMAIL PROTECTED]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
 

In fairness, I think Kurt has payed his dues enough to determine pretty 
accurately what might be on topic for this list.

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - ONTOPIC

2003-08-26 Thread DStark

I totally agree badpack3t. Not that we all should make it a point to carry
on Off-Topic threads, but not beat them down as if they were lepers either.
Anyone who has participated in at least a couple of mailing lists over the
last few years can vouch, there is not a mailing list out there (That
allows discussion) that does not suffer from an off topic posting every so
often. And pitching a bitch about Off Topic posts is even worse. I would
rather read 5 consecutive Off Topic messages than read the 50 Replies those
are going to generate from people disillusioned with the thoughts that
their reply is going to Halt the Off Topic discussion right in it's tracks.

// end off topic bitch about off topic bitching

- d






   
   
  "badpack3t"  
   
  <[EMAIL PROTECTED]To:   <[EMAIL PROTECTED]>  
   
  ls.com>cc:   
   
  Sent by:       Subject:  Re: 
[Full-Disclosure] CERT Employee Gets Owned - ONTOPIC   
  [EMAIL PROTECTED]
 
  .netsys.com  
   
   
   
   
   
  08/25/2003 05:12 PM  
   
  Please respond to badpack3t  
   
   
   
   
   




If you dont like it, un-subscribe or quit your bitching.  Instead of
replying with your lame comments making yourself look like a real ass.

-badpack3t

>> But seriously, sex with minors isn't exactly a parking ticket.
>
> But seriously, who cares. This is full-disclosure. Not
>
"people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-

> like".
>
> Kurt Seifried, [EMAIL PROTECTED]
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html





___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned - ONTOPIC

2003-08-26 Thread dhtml
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

It has everything to do with security. Human Honey Pot. Social Engineering
come to mind.

Bizzare calculation on a security expert's part to be trolling around
silly chat-rooms in the first place. Whole thing reeks of entrapment,
 but then again, what's he doing in the chat room in the first place.

Perhaps he has successfully penetrated the honey pot before, in which
case let him fry this time round.

Silly pevert.


- -
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAj9LlXIACgkQTAj0ZSCgbx4ttQCfcC1/INGs7B8g1cPdlDYIHZJj35EA
mwRQMoiCAdKt0n0q/HyCuyzB3e22
=KvoB
-END PGP SIGNATURE-




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-09-24 Thread Steve
On Tuesday 26 August 2003 06:38 am, Mathew Meins wrote:
> On Tue, 26 Aug 2003 06:03 pm, morning_wood wrote:
> > possibly its relevant because there was no actual minor involved..
> > only a cop over the age of 18.
> > if i say im going to meet you to kill you and i show up at said place
> > am i guilty of anything other than a threat

On another note the tornado in souther Florida is expect to flood 1000 homes 
and cause death and mayhem! This is the random news channel called 
full-disclosure is it not?

Maybe we can funnel weather.com and slashdot in here too?
-- 



Steve Szmidt
VP Information Technology
Video Group Distributors, Inc.
727-585-7737

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-09-24 Thread Bassett, Mark

On another note the tornado in souther Florida is expect to flood 1000
homes 
and cause death and mayhem! This is the random news channel called 
full-disclosure is it not?


tornado.. flood 1000 homes..  brain can't comprehend...
aaghhhh

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-09-24 Thread security snot
Sure, knowing that CERT/Honeynet is a bunch of pedophiles (and that the
behavior is sanctioned by Snosoft.com - that's right folks, Snosoft wants
your daughters raped).  Helps us all to "Know Our Enemy", so we can focus
on more important issues (keeping predators in prison, not doing business
with companies that support them, etc), and stop spending so much effort
trying to put incompetant Win9x users and their proxy scanners in prison
(like Lamo).

Be realistic.  Know your enemy.

---
"Whitehat by day, booger at night - I'm the security snot."
- CISSP / CCNA / A+ Certified - www.unixclan.net/~booger/ -
---

On Wed, 24 Sep 2003, Bassett, Mark wrote:

> 
> On another note the tornado in souther Florida is expect to flood 1000
> homes
> and cause death and mayhem! This is the random news channel called
> full-disclosure is it not?
> 
>
> tornado.. flood 1000 homes..  brain can't comprehend...
> aaghhhh
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-09-24 Thread KF
You seem to twist and contort damn near any and everything that people say... 
get a friggin life.

For the record I never said that I condone the guys actions... in context 
someone mentioned that his actions may have affected his performance at CERT.
Anything I said was simply to imply that I felt his work for CERT was up to 
snuff... nothing more nothing less. GET OVER IT!

-KF
CISSP / CCNA / A+ Certified - www.unixclan.net/~kf/
security snot wrote:
Sure, knowing that CERT/Honeynet is a bunch of pedophiles (and that the
behavior is sanctioned by Snosoft.com - that's right folks, Snosoft wants
your daughters raped).  Helps us all to "Know Our Enemy", so we can focus
on more important issues (keeping predators in prison, not doing business
with companies that support them, etc), and stop spending so much effort
trying to put incompetant Win9x users and their proxy scanners in prison
(like Lamo).
Be realistic.  Know your enemy.

---
"Whitehat by day, booger at night - I'm the security snot."
- CISSP / CCNA / A+ Certified - www.unixclan.net/~booger/ -
---
On Wed, 24 Sep 2003, Bassett, Mark wrote:



On another note the tornado in souther Florida is expect to flood 1000
homes
and cause death and mayhem! This is the random news channel called
full-disclosure is it not?

tornado.. flood 1000 homes..  brain can't comprehend...
aaghhhh
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread Joshua Thomas
Title: RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]





I'll remember that when your name is plastered all over the media.


Explain to me how this crime is relevant? 


He worked for CERT. Fine. So do a number of other people. Are we going to track all of their civil/criminal legal issues too? Do you believe that his crime puts the reputation of CERT into question, or damages their ability to do good work?

The crime was not computer-security related. It was an attempt to exploit another _person_, and the only relationship to computers was the medium of the communication. In short, it's out-of-scope for this list. 

Cheers,


Joshua Thomas
Network Operations Engineer
PowerOne Media, Inc.
[EMAIL PROTECTED] 


>If you dont like it, un-subscribe or quit your bitching.  Instead of
>replying with your lame comments making yourself look like a real ass.


-badpack3t


>> But seriously, sex with minors isn't exactly a parking ticket.
>
> But seriously, who cares. This is full-disclosure. Not
> "people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
> like".
>
> Kurt Seifried, [EMAIL PROTECTED]
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/




___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html





Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread KF
Joshua Thomas wrote:

I'll remember that when your name is plastered all over the media.

Explain to me how this crime is relevant?

He worked for CERT. Fine. So do a number of other people. Are we going 
to track all of their civil/criminal legal issues too? Do you believe 
that his crime puts the reputation of CERT into question, or damages 
their ability to do good work?

I certainly feel this has no relevance on the quality of work what so 
ever... actually Ian went above and beyond several times in helping us 
out when HP was breathing down our neck. What Ian does / did in his 
spare time should be of no concern to the security industry.

-KF

The crime was not computer-security related. It was an attempt to 
exploit another _person_, and the only relationship to computers was 
the medium of the communication. In short, it's out-of-scope for this 
list.

Cheers,

Joshua Thomas
Network Operations Engineer
PowerOne Media, Inc.
[EMAIL PROTECTED]
>If you dont like it, un-subscribe or quit your bitching.  Instead of
>replying with your lame comments making yourself look like a real ass.
-badpack3t

>> But seriously, sex with minors isn't exactly a parking ticket.
>
> But seriously, who cares. This is full-disclosure. Not
> 
"people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont- 

> like".
>
> Kurt Seifried, [EMAIL PROTECTED]
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread Jeremiah Cornelius
KF wrote:

Joshua Thomas wrote:

I'll remember that when your name is plastered all over the media.

Explain to me how this crime is relevant?

He worked for CERT. Fine. So do a number of other people. Are we 
going to track all of their civil/criminal legal issues too? Do you 
believe that his crime puts the reputation of CERT into question, or 
damages their ability to do good work?

I certainly feel this has no relevance on the quality of work what so 
ever... actually Ian went above and beyond several times in helping us 
out when HP was breathing down our neck. What Ian does / did in his 
spare time should be of no concern to the security industry.

-KF

The crime was not computer-security related. It was an attempt to 
exploit another _person_, and the only relationship to computers was 
the medium of the communication. In short, it's out-of-scope for this 
list.

Cheers,

Joshua Thomas
Network Operations Engineer
PowerOne Media, Inc.
[EMAIL PROTECTED]
>If you dont like it, un-subscribe or quit your bitching.  Instead of
>replying with your lame comments making yourself look like a real ass.
-badpack3t

>> But seriously, sex with minors isn't exactly a parking ticket.
>
> But seriously, who cares. This is full-disclosure. Not
> 
"people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont- 

> like".
>
> Kurt Seifried, [EMAIL PROTECTED]
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/
Everything else aside, it might serve well to remind us that the 
communications on this list and elsewhere are a small view on to the 
person posting.  Everyone - better or ill - is far more complex and 
involved that the views exchanged on the topics at hand.  Even the 
crap-flamers are possibly fine folk, you'd like immensely under other 
circumstance.

This was the most basic notion behind the formation of a code of 
"netiquette", and in fact good conduct in general.  FD is often one of 
the nadirs of expression with regard to this - if you don't count 
Kuro5hin and /.

We can agree to disagree about techincal issues and security 
methodology.  We are provided very little context for extending any 
judgement to the personal, and it would be better for everyone if this 
thread were killed - and we go back 'on topic' so to speak.

Translation:  I don't dislike YOU - just Windows.

--
Jeremiah Cornelius, CISSP, CCNA, MCSE, Debianaut
farm9 Security
[EMAIL PROTECTED] - mobile: 415.235.7689
"What would be the use of immortality to a person who cannot use well a half 
hour?"
--Ralph Waldo Emerson



___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread morning_wood
possibly its relevant because there was no actual minor involved..
only a cop over the age of 18.
if i say im going to meet you to kill you and i show up at said place am i
guilty of anything other than a threat


wood

- Original Message -
From: "Joshua Thomas" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 25, 2003 6:18 PM
Subject: RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]


> I'll remember that when your name is plastered all over the media.
>
> Explain to me how this crime is relevant?
>
> He worked for CERT. Fine. So do a number of other people. Are we going to
> track all of their civil/criminal legal issues too? Do you believe that his
> crime puts the reputation of CERT into question, or damages their ability to
> do good work?
>
> The crime was not computer-security related. It was an attempt to exploit
> another _person_, and the only relationship to computers was the medium of
> the communication. In short, it's out-of-scope for this list.
>
> Cheers,
>
> Joshua Thomas
> Network Operations Engineer
> PowerOne Media, Inc.
> [EMAIL PROTECTED]
>
> >If you dont like it, un-subscribe or quit your bitching.  Instead of
> >replying with your lame comments making yourself look like a real ass.
>
> -badpack3t
>
> >> But seriously, sex with minors isn't exactly a parking ticket.
> >
> > But seriously, who cares. This is full-disclosure. Not
> >
> "people-in-the-security-industry-who-are-accused-of-crimes-that-people-dont-
> > like".
> >
> > Kurt Seifried, [EMAIL PROTECTED]
> > A15B BEE5 B391 B9AD B0EF
> > AEB0 AD63 0B4E AD56 E574
> > http://seifried.org/security/
>
>
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread northern snowfall


if i say im going to meet you to kill you and i show up at said place am i
guilty of anything other than a threat
Intent is a statistically proven method for conviction.

Don

http://www.7f.no-ip.com/~north_

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread Mathew Meins
On Tue, 26 Aug 2003 06:03 pm, morning_wood wrote:
> possibly its relevant because there was no actual minor involved..
> only a cop over the age of 18.
> if i say im going to meet you to kill you and i show up at said place am i
> guilty of anything other than a threat

No, but you'd be at minimum be guilty of assault, and in some jurisdictions, 
you could even be canned for attempted murder.

(It's about time this thread got dropped.)

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread I.R.van Dongen
On Tue, 26 Aug 2003 06:01:41 -0500
northern snowfall <[EMAIL PROTECTED]> wrote:

> >
> >
> >if i say im going to meet you to kill you and i show up at said place am i
> >guilty of anything other than a threat
> >
> Intent is a statistically proven method for conviction.
Entrapment however is only legal in the US. Or not in my country atleast.

This person would not have been convicted by dutch law, I'm sure. Just as by dutch 
law, arresting hookers just because they respond to your invitation is not convictable.

Gr,

Ivo van Dongen

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [WAY Off Topic]

2003-08-26 Thread Damian Gerow
Thus spake I.R.van Dongen ([EMAIL PROTECTED]) [26/08/03 09:21]:
> > >if i say im going to meet you to kill you and i show up at said place am i
> > >guilty of anything other than a threat
> > >
> > Intent is a statistically proven method for conviction.
> Entrapment however is only legal in the US. Or not in my country atleast.

Entrapment is a *very* fine legal line in most countries.  A cop waiting at
a corner of a busy intersection to catch speeders/red-light runners is not
entrapment.  A cop following you for ten blocks after he's caught you
speeding before pulling you over *could* be entrapment.  Stress on "could".

> This person would not have been convicted by dutch law, I'm sure. Just as by dutch 
> law, arresting hookers just because they respond to your invitation is not 
> convictable.

This person hasn't been convicted by *any* law at this point.  They've been
charged.  Big difference, especially in countries where you are assumed
innocent until proven guilty.

(Coincidentally, there's nothing wrong with prostitution in Canada.  It's the
pimping and public solicitation that's illegal.)

In a desparate attempt to bring this all back on topic...

No, wait, I can't.  This has drifted so far that I can't possibly think of a
way to bring this all back to computer security.  Let's just let this guy
deal with his own problems, and not everybody jump on it because it's
sensational.

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread security snot
What the fuck is wrong with you?  I'm sorry, but this is one of the most
ridiculous things you've ever posted.  Worse than the idiotic advisories
your company publishes.  Worse than showing output from trivial exploits
that you won't release "for the good of the public".  Worse than said
output having names and email addresses listed in all capitals, with the
name DVDMAN amongst it.

"so what if he's a pedophile, he helped me out with the hp incident, so
he's not a bad guy."

I seriously hope your customers find out that you'll argue in favor of
perverts and pedophiles.  You fucking punk, never show your face around me
again or I'll smash you up.

Maybe that behavior is acceptable in the ghetto you're from, but it isn't
around me, and your idiotic defense for this loser really pisses me off.

"cert - exploiting the backdoors of our children since 2003"

---
"Whitehat by day, booger at night - I'm the security snot."
- CISSP / CCNA / A+ Certified - www.unixclan.net/~booger/ -
---

On Tue, 26 Aug 2003, KF wrote:

> I certainly feel this has no relevance on the quality of work what so
> ever... actually Ian went above and beyond several times in helping us
> out when HP was breathing down our neck. What Ian does / did in his
> spare time should be of no concern to the security industry.
>
> -KF

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread Robert Ahnemann
Am I the only who thinks he should have removed the mailing list from
this reply?  If you're trying to win the 'maturity war' bro, you're not
doing a good job with "I'll smash you up".  Is there a digest version of
this list that is somewhat filtered of this rubbish?

-Original Message-
From: security snot [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, August 26, 2003 1:34 PM
To: KF
Cc: [EMAIL PROTECTED]
Subject: Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

What the fuck is wrong with you?  I'm sorry, but this is one of the most
ridiculous things you've ever posted.  Worse than the idiotic advisories
your company publishes.  Worse than showing output from trivial exploits
that you won't release "for the good of the public".  Worse than said
output having names and email addresses listed in all capitals, with the
name DVDMAN amongst it.

"so what if he's a pedophile, he helped me out with the hp incident, so
he's not a bad guy."

I seriously hope your customers find out that you'll argue in favor of
perverts and pedophiles.  You fucking punk, never show your face around
me
again or I'll smash you up.

Maybe that behavior is acceptable in the ghetto you're from, but it
isn't
around me, and your idiotic defense for this loser really pisses me off.

"cert - exploiting the backdoors of our children since 2003"

---
"Whitehat by day, booger at night - I'm the security snot."
- CISSP / CCNA / A+ Certified - www.unixclan.net/~booger/ -
---

On Tue, 26 Aug 2003, KF wrote:

> I certainly feel this has no relevance on the quality of work what so
> ever... actually Ian went above and beyond several times in helping us
> out when HP was breathing down our neck. What Ian does / did in his
> spare time should be of no concern to the security industry.
>
> -KF

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] CERT Employee Gets Owned [Way Off Topic]

2003-08-26 Thread 404
The real question is what you all are spending time in this pointless bullshit. Back 
and forth like little kids...

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Speculation in the media (Was: Re: [Full-Disclosure] CERT Employee Gets Owned)

2003-08-26 Thread Peter Busser
Hi!

> You have *zero* knowledge about *this* incident.  And *that* was my
> point.  It's bad enough that the damn news media speculates about
> everything under the sun these days.

Right, the media do speculate about almost everything. Yesterday there was
speculation on the Dutch tv about ``cyberterrorism''. The program started about
sobig, saying it caused a lot of damage. Then it went on to stating that
developing sobig and others takes a lot of people, time and money. Therefore
the only organisations who are capable of doing such development are mafia
and terrorist organisations. The program went on to conclude that especially
public utilities, like power companies, are vulnerable to this kind of
terrorism. And of course the obligatory politician who vows to take measures
was part of the program.

I sent these people an e-mail message saying that the terrorist angle doesn't
sound very convincing. Terrorists are, it seems to me, after terrifying people.
I don't think shutting down a power plant is a really effective way to do that.
Also that most virusses and worms are likely to be written by individuals who
try to show off their skills.

The only answer I got was: We didn't address this subject, that was a different
program. (Nonwithstanding the fact that the title of the broadcast was:
Computer-terrorism, something everyone can verify at their web site.)

Groetjes,
Peter Busser
-- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: Speculation in the media (Was: Re: [Full-Disclosure] CERT Employee Gets Owned)

2003-08-26 Thread Andre Ludwig
Speculation is the mother of all f*ckups.

I know this list is a "free" list where people can discuss things back and
forth.  But come on people, i am glad the original poster posted this story.
I find it amusing and well informative.  Well can we all agree to disagree
and if you want to flame please do it off list, as it is more fun that way
(think of all the icky words and foul language u can use!).   Anyways thanks
to the original poster i do think it was a bit OT but i was glad i read it. 


Andre Ludwig

-Original Message-
From: Peter Busser [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 26, 2003 1:15 PM
To: [EMAIL PROTECTED]
Subject: Speculation in the media (Was: Re: [Full-Disclosure] CERT
Employee Gets Owned)


Hi!

> You have *zero* knowledge about *this* incident.  And *that* was my
> point.  It's bad enough that the damn news media speculates about
> everything under the sun these days.

Right, the media do speculate about almost everything. Yesterday there was
speculation on the Dutch tv about ``cyberterrorism''. The program started
about
sobig, saying it caused a lot of damage. Then it went on to stating that
developing sobig and others takes a lot of people, time and money. Therefore
the only organisations who are capable of doing such development are mafia
and terrorist organisations. The program went on to conclude that especially
public utilities, like power companies, are vulnerable to this kind of
terrorism. And of course the obligatory politician who vows to take measures
was part of the program.

I sent these people an e-mail message saying that the terrorist angle
doesn't
sound very convincing. Terrorists are, it seems to me, after terrifying
people.
I don't think shutting down a power plant is a really effective way to do
that.
Also that most virusses and worms are likely to be written by individuals
who
try to show off their skills.

The only answer I got was: We didn't address this subject, that was a
different
program. (Nonwithstanding the fact that the title of the broadcast was:
Computer-terrorism, something everyone can verify at their web site.)

Groetjes,
Peter Busser
-- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html