[124036] in North American Network Operators' Group
Re: NSP-SEC
daemon@ATHENA.MIT.EDU (Gadi Evron)
Sat Mar 20 16:14:57 2010
Date: Sat, 20 Mar 2010 22:12:40 +0200
From: Gadi Evron <ge@linuxbox.org>
To: nanog@nanog.org
In-Reply-To: <1269110278.1220.147.camel@petrie>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 3/20/10 8:37 PM, William Pitcock wrote:
> That is not what I mean and you know it.
What do you mean than? Hank made a good point on the type of traffic
normally going through these groups.
> What I mean is: why can't anyone contribute valuable information to the
> security community? It is next to impossible to meet so-called 'trusted
> people' if you're new to the game, which is counter-productive.
Well, that's not transparency at all. That's about being able to get
connected, and be trusted. That's called a process.
Now, I've been preaching public engagement for years now, and indeed
also made several attempts in this regard -- some very successful,
others failed miserably.
There are three suggestions I can make:
1. Join the open mailing lists and show your usefulness. Places where a
lot of us hang out (depending on communities): NANOG, funsec.
2. Show you are responsive and responsible in handling issues in your
own back yard.
3. Go to conferences and drink beer with people.
> If you're a 15 year old kid and you just discovered a way to own the
> latest IOS, for example, how do you know who to tell about it?
That's a completely different question yet again, on vulnerability
disclosure. In this particular case, try Cisco PSIRT.
I recently wrote a post on how to handle the PR aspects of vulnerability
disclosure, but it covers the basics in the first few paragraphs and I
think it will clear the subject for you.
http://www.darkreading.com/blog/archives/2009/12/security_pr_str.html
Gadi.
>
> William
>
>
--
Gadi Evron,
ge@linuxbox.org.
Blog: http://gevron.livejournal.com/
