We're going to use the method of modus tollens. If you can't handle that, then you should probably stop reading right now.

Microsoft is the pioneer of "responsible disclosure", and they lay out how it works here:

The responsibility for Microsoft's products rests with Microsoft alone, and we take that responsibility very seriously. However, there has traditionally been an unwritten rule among security professionals that the discoverer of a security vulnerability has an obligation to give the vendor an opportunity to correct the vulnerability before publicly disclosing it.

This serves everyone's best interests, by ensuring that customers receive comprehensive, high-quality updates for security vulnerabilities but are not exposed to malicious users while the update is being developed. After customers are protected, public discussion of the vulnerability is entirely in order, and helps the industry at large improve its products.

We can easily demonstrate ~Q. Here are a couple of examples:

January 21, 2010, 3:40PM
Microsoft today admitted it knew of the Internet Explorer flaw used in the attacks against Google and Adobe since September last year.

The flaw was in the Microsoft Security Response Center's (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S. companies forced the company to release an emergency, out-of-band IE update. The IE update applies to all versions of the browser on all Windows OS versions and patches at least eight documented vulnerabilities that could lead to remote code execution attacks.

The patches are included in the critical MS10-002 bulletin.

The vulnerability used in the attacks (CVE-2010-0249) was privately reported to Microsoft last August by Meron Sellen, a white-hat hacker at BugSec, an Israeli security research company. Microsoft program manager Jerry Bryant said the company confirmed the severity of the flaw in September and planned to ship a fix in a cumulative IE update next month.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2010-0249.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
Yes. Microsoft is aware of limited attacks attempting to exploit the vulnerability.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
While the original report was reported privately to Microsoft, the vulnerability [CVE-2010-0806] was later disclosed publicly by a separate party.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
Yes. Microsoft is aware of attacks attempting to exploit the vulnerability.

So we have two separate examples of ~Q from 2010 alone!

Thus, using modus tollens, and claims and evidence solely from Microsoft, we can demonstrate that ~P, or in other words, the discoverer of a security vulnerability does not have an obligation to give the vendor an opportunity to correct the vulnerability before publicly disclosing it.

Sadly, even Google, who is rather forward-thinking in terms of its policies for dealing with third-party security researchers, can't even come to accept ~P, and instead is trying to fix responsible disclosure. Good luck with that.]]>http://geekable.com/blog/2010/07/21/microsoft_proves_responsible_disclosure_doesnt_work.html2010-07-21T08:42:07Z2010-07-21T08:45:23Z

...The story quotes Ted Sampley, a Green Beret in Vietnam whose web site has led the charge for some veterans against Kerry. Sampley says, "I truly believe that John Kerry's testimony before Congress [against the Vietnam War] had a big role in people who were supposedly peaceniks spitting on vets and calling them baby killers when they got home."

There are two problems with Sampley's "belief" as reported by the Plain Dealer. First, guilt by association is always a weak argument, and more likely a smear tactic that is unfair to the subject. America has learned this before, during the Palmer Raids of WWI, the McCarthyism of the Cold War, and now during the Ashcroft era of the War on Terror and the Patriot Act.

More important, however, is that the charge is simply not rooted in reality. It is both unfair to Senator Kerry and to the Vietnam-era peace movement. The fact is, there is absolutely no record of any peace activist taunting or spitting upon returning veterans. It is myth, and like most myths it is hard to dislodge.

In 1995 sociologist Thomas Beamish and his colleagues analyzed all peace movement-related stories from 1965 - 1971 in the NY Times, LA Times, and SF Chronicle (495 stories). They found no instance of any spitting on returned troops by peace movement members, nor any taunting. Indeed, they found few examples of negative demonstrations involving returning troops of any kind, or even of simple disapproval of returning soldiers. Three years later, sociologist Jerry Lembcke conducted a similarly exhaustive study for his book, The Spitting Image, with like results. He discovered war protesters being spat upon by war supporters, and hostile acts toward Vietnam veterans by conservative, pro-war groups like the VFW, but no taunting or spitting on returned veterans by peace movement members. Returned veterans and in-service GIs were welcomed in the peace movement, and many assumed leadership roles. Yet the myth endures...

“so why do we feel that our health care in the U.S. is so much better than those other countries?”

Because people in the USA have had it drilled into them, over and over again, that we are the best country in the world, at absolutely everything, and that we have nothing at all to learn from anyone, ever.

I think I'm going to get in trouble for this, but you know what? I have a theory that you can't find any saints anymore because of psychotropic medication. I think that [in] the old days, the saints were hearing voices, and they didn't have any thorazine to calm them down. Now, that we have all of this medication available to us, you can't find a saint anymore!

Young IT employees pose a challenge to many managers who say the Millennial generation holds employers up to unrealistic expectations and makes unreasonable demands for their services.

Millennials -- employees between the ages of 18 and 31 -- represent the top challenge for IT managers, according to survey results released Thursday from Atlantic Associates, an IT staffing company.

Atlantic Associates polled more than 100 Massachusetts executives on the challenges they face and more than 50% of respondents described those teen and 20-something employees as the "toughest generation to manage." Generation Xers (ages 32 to 42 years old) placed second with 17% of respondents saying they pose a management challenge.

Jack Harrington, co-founder and principal of the staffing firm, says the problem between employers and the younger generation just entering the workforce can be traced back to the employees' upbringing or an easier way of life for children in the United States today.

"The issue managers are facing is with retention, not hiring. That means the work environment is not living up to the employee's expectation," he says. For instance, many younger workers expect to get an office immediately or be paid at a rate higher than entry level.

"Millennials are coming in with high expectations and are disillusioned about the reality of a work place. They feel they should be rewarded and start at the top, when we all know you have to work your way up. They have been raised to be rewarded often and when you get into the workforce those rules change a bit," Harrington says.

The most illuminating section comes later:

"To reach a good working balance, Millennials will have to change their ideas somewhat, but the work environment will also change to appeal to these very in-demand employees," he says.

This is another example of conservatives loving the labor market right up until it screws them over.

(For more on fogeys insulting young adults, see here.)

]]>http://geekable.com/blog/2008/01/12/when_we_all_know.html2008-01-12T15:32:52Z2008-01-12T15:33:49Z