🚀 go-pugleaf

>What about a mailing list where they distribute disclosures encrypted
>by PGP (encrypted with the public key of the individual subscribers) ?
   
   All this will do is to make sure that the only person who can read the
message is the person whom it is sent to. It does nothing to prevent a
malicious "cracker" from getting on the list in the first place.

   There have been a number of suggestions that the only people allowed on
the list are those who are identified as the technical contact. Perhaps I'm
paranoid but I believe that there are governments and commercial
institutions that have something to gain by sponsoring some crackers. The
cover of government or commercial enterprise lends legitimacy to these
crackers making them appear quite trustworthy since they are supported by a
large organization. 

   I agree with those that state that full disclosure should only come AFTER
the patch is available.

   Note the use of the word cracker rather than hacker. A hacker is someone
that works out a computer problem because they enjoy the mental challenge. A
cracker on the other hand finds challenge in seeing what damage they can do
to somebody's system. But this is a completely different subject...

              Ken                 Internet: kgunther@delphi.com
                                  Packet:   WB2KWC@WB2IBO.#NLI.NY.USA.NA