Full disclosure

Full disclosure or Full Disclosure may refer to:

See also

Full disclosure (mailing list)

Full disclosure was an unmoderated security mailing list generally used for discussion about information security and disclosure of vulnerabilities. The list was created on 9 July 2002 by Len Rose and was administered by Len Rose, who later handed it off to John Cartwright. After Len Rose shut down netsys.com, the list was hosted and sponsored by Secunia.

On 25 March 2014 the Full Disclosure mailing list was "rebooted" by Fyodor. The site is now part of seclists.org and no longer associated with grok.org.uk.

Notable 0-days first disclosed in Full-disclosure

References

External links

Full disclosure (computer security)

In the field of computer security, independent researchers often discover flaws in software that can be abused to cause unintended behaviour, these flaws are called vulnerabilities. The process by which the analysis of these vulnerabilities is shared with third parties is the subject of much debate, and is referred to as the researcher’s disclosure policy. Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. The primary purpose of widely disseminating information about vulnerabilities is so that potential victims are as knowledgeable as those who attack them.

In his essay on the topic, Bruce Schneier stated "Full disclosure -- the practice of making the details of security vulnerabilities public -- is a damned good idea. Public scrutiny is the only reliable way to improve security, while secrecy only makes us less secure".Leonard Rose, co-creator of an electronic mailing list that has superseded bugtraq to become the de facto forum for disseminating advisories, explains "We don't believe in security by obscurity, and as far as we know, full disclosure is the only way to ensure that everyone, not just the insiders, have access to the information we need."