<p dir="ltr">That is true. I always forget about the Australian CERTs.</p>
<p dir="ltr">I have considered them in the past. But from memory, CERT for gov is exactly that. They work with gov direct. There isn't a provision for the public to report a .gov vuln. Although I guess you could email them.</p>
<p dir="ltr">Same with auscert. They are membership based. How can the public report to them? And what if the vendor isn't a paying auscert member?</p>
<p dir="ltr">Why tell a 3rd party about a critical issue?</p>
<p dir="ltr">This has always been the issue with CERT in Australia. The US CERT is much better. Anyone can approach them about a protocol bug in multiple OSes and US CERT will get it fixed and notify the critical internet backbone vendors to have them secured first.</p>
<p dir="ltr">The fact AU CERT(s) are rarely spoken of is testament to this issue we find ourselves in.</p>
<p dir="ltr"><a href="http://howdoireportavuln.com">http://howdoireportavuln.com</a> is a good example of how needlessly complex bug reporting has become.<br>
</p>
<div class="gmail_quote">On 9 Jan 2014 13:29, "Peter Tiggerdine" <<a href="mailto:ptiggerdine@gmail.com">ptiggerdine@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">Isn't this the role of govCERT for .gov.au and AusCERT for the private sector in .au?</p>
<p dir="ltr">Ideally domain owner should keep their whois details correct and up to date so abuse@ actually goes to someone with a clue.</p>
<div class="gmail_quote">On 09/01/2014 12:25 PM, "Patrick Webster" <<a href="mailto:patrick@aushack.com" target="_blank">patrick@aushack.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">I like the idea in principle.</p>
<p dir="ltr">I didn't attend the 2011 Ruxcon but I was told the AFP's Alex Tilley suggested to the room, that in situations such as the FSS incident, the discoverer contact and disclose the bug to them and they will notify the vendor.</p>
<p dir="ltr">While nice in theory, I have a few issues with this. I won't go into their lack of resources or why they shouldn't be told about 3rd party remote exploits etc, but I will say this one thing:</p>
<p dir="ltr">Police are a paramilitary force with the primary function of arresting, charging and bringing people before the Court.</p>
<p dir="ltr">So with that in mind, my advice is to only speak to police when you want somebody arrested and charged.</p>
<p dir="ltr">I certainly wouldn't touch them with a 6 foot pole about an SQL injection in a VIC transport website (unless it was their own <a href="http://afp.gov.au" target="_blank">afp.gov.au</a> site which is a different story).<br>
</p>
<div class="gmail_quote">On 9 Jan 2014 10:41, "Jake Anderson" <<a href="mailto:yahoo@vapourforge.com" target="_blank">yahoo@vapourforge.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>Given that one of the jobs of the
police is prevent crime could AFP perhaps set up a vuln reporting
doohickey?<br>
crimestoppers for the interweb?<br>
<br>
heh I wonder how that would go, reporting a vuln to crimestoppers,
much as you would report an open door to a closed bank to the
police why should you not do the same thing when online?<br>
<br>
It might be less work for them than trying to prosecute 15 year
olds who have access to hacking tools like google.<br>
That and getting a call/letter from the AFP or visit from a
uniformed officer reporting a vuln may well light a fire under the
party in terms of getting something done about it.<br>
<br>
On 09/01/14 06:01, thelionroars wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr"><br>
<div class="gmail_extra">
<div class="gmail_quote">On 8 January 2014 23:30, Patrick
Webster <span dir="ltr"><<a href="mailto:patrick@aushack.com" target="_blank">patrick@aushack.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">It is time law enforcement caught up with the
Australian community acceptable standards.<br>
</p>
</blockquote>
<div> <br>
</div>
<div>Agreed. Actually, maybe the Federal Government should
be looking at legislating to ensure protection of people
who try to inform organisations of these vulnerabilities.
They should consider legislating mandatory disclosure of
information security breaches while they are it.<br>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<br>
</div>
</blockquote></div>
<br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div>
</blockquote></div>