NSP-SEC

[hank at efes.iucc.ac.il (Hank Nussbacher)]

On Fri, 19 Mar 2010, William Pitcock wrote:

> On Fri, 2010-03-19 at 08:31 -0500, John Kristoff wrote:
>> An ongoing area of work is to build better closed,
>> trusted communities without leaks.
>
> Have you ever considered that public transparency might not be a bad
> thing?  This seems to be the plight of many security people, that they
> have to be 100% secretive in everything they do, which is total
> bullshit.
>
> Just saying.

How exactly would being transparent for the following help Internet 
security:

"I am seeing a new malware infection vector via port 91714 coming from the 
IP range of 32.0.0.0/8 that installs a rootkit after visiting the web page
http://www.trythisoutnow.com/.  In addition, it has credit card and pswd 
stealing capabilities and sends the details to a maildrop at 
trythisoutnow at gmail.com"

The only upside of being transparent is alerting the miscreant to change 
the vector and maildrop.

Regards,
Hank