SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Bugtraq</title>

</head>

Bugtraq

</h1>

</header>

Bugtraq was an <a href="Electronic_mailing_list" class="mw-redirect" title="Electronic mailing list">electronic mailing list</a> dedicated to issues about <a href="Computer_security" title="Computer security">computer security</a>. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It was a high-volume mailing list, with as many as 776 posts in a month,<a href="#cite_note-1">[1]</a> and almost all new security vulnerabilities were discussed on the list in its early days. The forum provided a vehicle for anyone to disclose and discuss <a href="Vulnerability_(computing)" class="mw-redirect" title="Vulnerability (computing)">computer vulnerabilities</a>, including security researchers and product vendors. While the service has not been officially terminated, and its archives are still publicly accessible, no new posts have been made since January 2021.

<div class="mw-heading mw-heading2"><h2 id="History">History</h2></div>

Bugtraq was created on November 5, 1993 by Scott Chasin<a href="#cite_note-2">[2]</a> in response to the perceived failings of the existing <a href="Internet" title="Internet">Internet</a> security infrastructure of the time, particularly <a href="CERT/CC" class="mw-redirect" title="CERT/CC">CERT</a>. Bugtraq's policy was to publish vulnerabilities, regardless of vendor response, as part of the <a href="Full_disclosure_(computer_security)" title="Full disclosure (computer security)">full disclosure</a> movement of vulnerability disclosure. The list was sometimes spelled BugTraq, but common usage over the years called it Bugtraq. It grew to 2,500 subscribers by May 19, 1995<a href="#cite_note-3">[3]</a> and over 40,000 by February, 2000.<a href="#cite_note-4">[4]</a>

<a href="Elias_Levy" title="Elias Levy">Elias Levy</a>, known as Aleph One (alluding to the cardinal number <a href="Aleph_one" class="mw-redirect" title="Aleph one">aleph one</a>), noted in an interview that "the environment at that time was such that vendors weren't making any patches. So the focus was on how to fix software that companies weren't fixing." Levy considered the idea of abstracting Bugtraq to be platform-specific, to reduce irrelevant information for those interested only in particular <a href="Operating_system" title="Operating system">operating systems</a>.<a href="#cite_note-5">[5]</a><a href="#cite_note-6">[6]</a>

Bugtraq was originally hosted at Crimelab.com, run by Scott Chasin. It was moved to the Brown University NetSpace Project—which has since been reorganized as the <a rel="nofollow" class="external text" href="http://www.netspace.org/">NetSpace Foundation</a>—on June 5, 1995, the same day its moderation began. In July 1999 it became the property of <a href="SecurityFocus" title="SecurityFocus">SecurityFocus</a> and was moved there.<a href="#cite_note-7">[7]</a><a href="#cite_note-8">[8]</a> SecurityFocus was acquired in full by Symantec on August 6, 2002.<a href="#cite_note-Symantec_Acquisition-9">[9]</a> As of February 25, 2020, traffic from the list stopped without explanation.<a href="#cite_note-10">[10]</a> In 2002, the <a href="Full_disclosure_(mailing_list)" class="mw-redirect" title="Full disclosure (mailing list)">Full-Disclosure mailing list</a> was created because many people feeling the list had "changed for the worse".<a href="#cite_note-11">[11]</a>

On April 30, 2020, <a href="Accenture" title="Accenture">Accenture Security</a> completed its acquisition of Symantec's Cybersecurity Services including <a href="SecurityFocus" title="SecurityFocus">SecurityFocus</a>, which included Bugtraq.<a href="#cite_note-12">[12]</a>

<div class="mw-heading mw-heading2"><h2 id="Controversy">Controversy</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Moderation">Moderation</h3></div>

The mailing list was originally unmoderated, then received only occasional moderation that many participants considered inadequate. In one incident, what appeared to be sensitive credit-card information was allowed to be posted.<a href="#cite_note-13">[13]</a> Subsequent posts challenged many aspects of the list, including the full disclosure of vulnerabilities, and suggested it either go unmoderated or that moderators change the way they approached it.<a href="#cite_note-14">[14]</a>

Moderation began on June 5, 1995. <a href="Elias_Levy" title="Elias Levy">Elias Levy</a> moderated the list from June 14, 1996 until he stepped down on October 15, 2001. David Mirza Ahmad, one of the many co-authors of <a rel="nofollow" class="external text" href="http://www.oreilly.com/catalog/1928994709/">Hack Proofing Your Network, Second Edition</a>, took over from Levy and continued until he stepped down on February 23, 2006.<a href="#cite_note-15">[15]</a> David McKinney, a <a rel="nofollow" class="external text" href="https://web.archive.org/web/20060908113851/http://www.symantec.com/Products/enterprise?c=prodinfo&refId=988&cid=1017">DeepSight threat analyst</a> at <a href="NortonLifeLock" class="mw-redirect" title="NortonLifeLock">Symantec</a>, took over from Ahmad. Moderation duties have now been assumed by another DeepSight analyst, Prasanna.<a href="#cite_note-New_Bugtraq_Administrator-16">[16]</a>

During his tenure, Ahmad proposed the list adopt more "community involvement" and "a more democratic process for making important decisions on the future of Bugtraq and the Security Focus website".<a href="#cite_note-17">[17]</a> Despite receiving feedback according to Alfred Huger,<a href="#cite_note-18">[18]</a> further community involvement did not manifest.

<div class="mw-heading mw-heading3"><h3 id="Delays_in_Moderation">Delays in Moderation</h3></div>

Delays in list moderation occurred several times, sometimes due to technical issues<a href="#cite_note-19">[19]</a> and <a href="Denial-of-service_attack#Distributed_attack" title="Denial-of-service attack">DDoS attacks</a>.<a href="#cite_note-20">[20]</a> Other times, posts to the lists vanished due to unspecified "mail problems".<a href="#cite_note-21">[21]</a> In August, 1997, the list went quiet for several days as Aleph One was on vacation and the person entrusted to moderate failed to do so.<a href="#cite_note-22">[22]</a> After the list was transitioned to SecurityFocus and Symantec acquired the company, some researchers noticed that their posts to the lists were delayed, as moderation no longer occurred on weekends. Despite the delays, vulnerability information from some of those posts were used in Symantec's DeepSight commercial offering which includes a vulnerability database.<a href="#cite_note-23">[23]</a>

<div class="mw-heading mw-heading3"><h3 id="Copyrighted_Advisories">Copyrighted Advisories</h3></div>

In late 2000, when Levy posted the full content of a Microsoft security advisory to the list, Microsoft complained that it was a copyright violation.<a href="#cite_note-24">[24]</a>

<div class="mw-heading mw-heading2"><h2 id="Demise">Demise</h2></div>

As of February 24, 2020, Symantec stopped approving posts to Bugtraq.<a href="#cite_note-:0-25">[25]</a> No final message from the list administrators and no statement from Symantec was posted. This came after the <a rel="nofollow" class="external text" href="https://www.securityfocus.com/bid/">BID vulnerability database</a> maintained by Symantec stopped being publicly updated on July 26, 2019, just over one month before it was acquired by <a href="Broadcom_Inc." class="mw-redirect" title="Broadcom Inc.">Broadcom</a>.<a href="#cite_note-26">[26]</a> On January 1, 2021, Accenture announced that Bugtraq would be shut down.<a href="#cite_note-27">[27]</a> On January 15, 2021, what appeared to be a final email was sent to the list confirming it was being shut down, citing "resources for the BugTraq mailing list have not been prioritized".<a href="#cite_note-28">[28]</a> However, the decision was reconsidered based on feedback from the community; and on January 17, 2021, Accenture posted a message to the list announcing the continuation of the Bugtraq, <a href="#cite_note-29">[29]</a> and followed up with a lengthier blog explaining their goals.<a href="#cite_note-30">[30]</a> The continuation announcement was the last message ever published to the mailing list and no further activity is recorded in any of the public archives.

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/">"Bugtraq"</a>. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-2"><a href="#cite_ref-2">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.securityfocus.com/archive/1/description#0.2.1">"History"</a>. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-3"><a href="#cite_ref-3">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/1995/May/189">"From the moderator: READ Please"</a>. 1995-05-19. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2000/Feb/191">"Administrivia"</a>. 2000-02-14. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-5"><a href="#cite_ref-5">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/1999/Oct/123">"Administrivia"</a>. 1999-10-11. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2001/Mar/137">"Administrivia: Mailing List Software"</a>. 2001-03-10. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/1999/Jul/29">"Administrivia"</a>. 1999-07-05. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-8"><a href="#cite_ref-8">^</a> <cite id="CITEREFMasnick2002" class="citation web cs1">Masnick, Mike (2002-07-17). <a rel="nofollow" class="external text" href="https://www.techdirt.com/articles/20020717/1825218.shtml">"Symantec Buys SecurityFocus/BugTraq"</a>. <a href="TechDirt" class="mw-redirect" title="TechDirt">TechDirt</a>. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-Symantec_Acquisition-9"><a href="#cite_ref-Symantec_Acquisition_9-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20031206020446/http://www.symantec.com/press/2002/n020806.html">"Symantec Acquisition of SecurityFocus Completed"</a>. 2002-08-06. Archived from <a rel="nofollow" class="external text" href="http://www.symantec.com/press/2002/n020806.html">the original</a> on December 6, 2003. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-10"><a href="#cite_ref-10">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2020/Feb/index.html">"Bugtraq: 40 messages starting Feb 03 20 and ending Feb 25 20"</a>. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-11"><a href="#cite_ref-11">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/fulldisclosure/2002/Jul/7">"Re: Announcing new security mailing list"</a>. July 11, 2002. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-12"><a href="#cite_ref-12">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://newsroom.accenture.com/news/accenture-completes-acquisition-of-broadcoms-symantec-cyber-security-services-business.htm">"Accenture Completes Acquisition of Broadcom's Symantec Cyber Security Services Business"</a>. Accenture.com. April 30, 2020. Retrieved 2020-01-17.</cite>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/1994/Oct/73">"Time for moderation?"</a>.</cite>

</li>

<li id="cite_note-14"><a href="#cite_ref-14">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2004/Jan/159">"What is the point here?"</a>.</cite>

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2006/Feb/444">"Administrivia: New Bugtraq moderator"</a>.</cite>

</li>

<li id="cite_note-New_Bugtraq_Administrator-16"><a href="#cite_ref-New_Bugtraq_Administrator_16-0">^</a> <a rel="nofollow" class="external text" href="http://www.securityfocus.com/archive/1/425940/30/1860/threaded">SecurityFocus</a>

</li>

<li id="cite_note-17"><a href="#cite_ref-17">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2003/Sep/131">"Administrivia: [Important] Community Involvement in the Future of Bugtraq"</a>.</cite>

</li>

<li id="cite_note-18"><a href="#cite_ref-18">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2003/Sep/219">"Results of the vote query"</a>.</cite>

</li>

<li id="cite_note-19"><a href="#cite_ref-19">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2002/Jun/325">"Administrivia: Recent list delays"</a>.</cite>

</li>

<li id="cite_note-20"><a href="#cite_ref-20">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2000/Feb/191">"Administrivia"</a>.</cite>

</li>

<li id="cite_note-21"><a href="#cite_ref-21">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2001/May/58">"Administrivia: Mail Problems"</a>.</cite>

</li>

</li>

<li id="cite_note-23"><a href="#cite_ref-23">^</a> <cite id="CITEREFjerichoattrition2017" class="citation web cs1">jerichoattrition (June 16, 2017). <a rel="nofollow" class="external text" href="https://archive.today/20181101194326/https://blog.osvdb.org/2017/06/16/your-yearly-reminder-to-post-to-full-disclosure-not-bugtraq/">"Your yearly reminder to post to Full-Disclosure, not Bugtraq"</a>. Archived from <a rel="nofollow" class="external text" href="https://blog.osvdb.org/2017/06/16/your-yearly-reminder-to-post-to-full-disclosure-not-bugtraq/">the original</a> on 2018-11-01. Retrieved 2020-05-17.</cite>

</li>

<li id="cite_note-24"><a href="#cite_ref-24">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2000/Dec/103">"Administrivia: No More Microsoft Bulletins"</a>.</cite>

</li>

<li id="cite_note-:0-25"><a href="#cite_ref-:0_25-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2020/Feb/index.html">"Bugtraq: by thread (Feb 2020 Archive)"</a>.</cite>

</li>

<li id="cite_note-26"><a href="#cite_ref-26">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.cnbc.com/2019/08/08/broadcom-acquires-symantecs-enterprise-business-for-10point7-billion.html">"Broadcom acquires Symantec's enterprise business for $10.7 billion"</a>. <a href="CNBC" title="CNBC">CNBC</a>. 8 August 2019. Retrieved 19 May 2020.</cite>

</li>

<li id="cite_note-27"><a href="#cite_ref-27">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2021/Jan/0">"BugTraq Shutdown"</a>. seclists.org. 2021-01-15. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-28"><a href="#cite_ref-28">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2021/Jan/0">"Bugtraq: BugTraq Shutdown"</a>. seclists.org. Retrieved 2021-01-15.</cite>

</li>

<li id="cite_note-29"><a href="#cite_ref-29">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://seclists.org/bugtraq/2021/Jan/1">"On Second Thought..."</a> seclists.org. 2021-01-17. Retrieved 2021-01-17.</cite>

</li>

<li id="cite_note-30"><a href="#cite_ref-30">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.accenture.com/us-en/blogs/cyber-defense/future-of-bugtraq">"The Future of Bugtraq | Accenture"</a>. WordPressBlog. Retrieved 2021-02-07.</cite>

</li>

</ol></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="http://www.securityfocus.com/archive">SecurityFocus - Mailing Lists</a> (Bugtraq is the first mailing list under the Most Popular heading)</li>

<li><a rel="nofollow" class="external text" href="http://www.bugtraq.gigfa.com">BUGTRAQ - VULNERABLE SITES TRACKER</a> (First Professional Vulnerable Sites Tracker)</li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-03-28" href="https://en.wikipedia.org/wiki/?title=Bugtraq&oldid=1282718328">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>