---------- Forwarded message ----------
Date: Tue, 17 Sep 2002 17:22:06 +0200
From: Florian Weimer 
To: hellNbak 
Cc: full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] openssl exploit code

hellNbak  writes:

> Source?  URL?  Article?  I personally would be very surprised if this
> happened.  But stranger things have happened.

I've got the following quote from Computerzeitung, but no direct URL:

| Bugtraq wird den Industrienormen fьr Security-Verцffentlichungen
| folgen, wie es das heute bereits tut. Es gibt immer Verzцgerungen,
| sogar bei Bugtraq: Die Sicherheitslьcke muss verifiziert und der
| Hersteller alarmiert werden. Typischerweise rдumt man ihm immer eine
| Gefдlligkeitszeit ein, um einen Patch zu entwickeln. Diesen Standard
| werden wir beibehalten.

John Schwarz, Chief Operating Office, Symantec.

Approximate translation:

Bugtraq will follow the industry norms for security disclosures, like
it does now.  There are always delays, even with Bugtraq: A security
vulnerability has to be verified, and the vendor has to be alarmed.
Typically, the vendor gets a grace period to develop a patch.  We will
keep this standard.

(Sorry, English isn't my native tongue.)
=========================