Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision

[Andrea Barisani <lcars () ocert org>]

Hi Solar,

> I think this is a rare exception to oCERT's policy, too.  It says:
>
> "- under extremely exceptional circumstances, if the oCERT Team and all
> the parties involved feel the need for longer time, a 2 months embargo
> can be applied, in this case we would clearly document the decision for
> public review"

> Andrea - you could want to "clearly document the decision for public
> review" now, although I guess your rationale was similar to mine (when I
> decided not to object to the unusually long embargo period this time).

As stated in our timeline the embargo date was requested by reporters:
"2011-09-25: vulnerability report received, reporters set embargo date to December 27th"

Our disclosure policy also says:
"- in any circumstance reporter preference will always be honoured in case a
joint agreement is not reached, as oCERT would be anyway unable to force its
embargo"

We tried to negotiate an earlier embargo time as, obviously, many complained
about the unfortunate timing considering xmas holidays but the reporters really
wanted to release this after the CCC talk.

It is oCERT policy to not leak reports before the desired date set by the
reporters if a more favourable one is not agreed upon.

Hope this clarifies the exception.

Cheers

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | OSS Computer Security Incident Response Team

<lcars () ocert org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"