Symantec to Acquire SecurityFocus

cbv writes "Symantec Corp. today announced the acquisition of SecurityFocus for approximately US$75 million in cash. The press release reads, 'With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats.' The transaction is expected to close by early to mid-August 2002."

Conflict of Interest?

[darylp]

Will we be seeing more minor security issues inflated to cataclysmic proportions just so Symantec can sell a few more virus scanners?

Loss of credibility

[BobRoss]

This buyout (sellout?) makes the site a lot less credible in my opinion. They are simply going to use the site to sell more virus protection software.

symantec will NEVER be secure

[GoatPigSheep]

their products will never be secure as long as they do not detect the fbi's spy software.

Not Sure What To Make Of This

[White Roses]

So, a company that I do not fully trust when it comes to acurate, honest security reporting purchased a forum (company?) which I do trust on those same matters.

I don't really know what to say. It'd be like Ford buying Volvo or something. Oh, wait . . .

this is the company that would allow magic lantern

[NetBoy]

Hmmm, this reminds me of something, lets see....

Ahh, Symantec pledges to acquiese to FBI backdoor demands [politechbot.com]

This is a real problem and needs to be addressed.

Has Symantec policy changed with respect to things
like magic lantern and so forth?

bugtraq. Poof.

Re:Conflict of Interest?

[tcc]

I'd be more worried about them *NOT* releasing some security issues of those 800 pounds gorilla that promotes security through obscurity instead of writing safer code.

Symantec is a corporation after all. If let's say, a certain company would cut them vital information required for the lowlevel of the system so that their antivirus technology work effectively (on their future OS), well I can see a very *VERY* persuasive effort that could just work.

I am happy for the people at security focus if it pays off their hard work, but I am worried about the quality and most importantly, the neutrality of the service that will result from this acquisition.

Re:The new BugTraq

[kir]

While exaggerated, I think your post is probably and example of the future of any mailing list done by SecurityFocus. Sad. Symantec always seemed cheap and sleezy to me while SecurityFocus at least tried to be legitimate.

With this purchase, SecurityFocus' credibility (at least with me) has gone out the window. I can't see how they can continue to be credible when they've got a company in charge that ONLY cares about the bottom line. Just look at their irresponsible virus warnings (as you've so clearly demonstrated). Boooooo!

Re:What Aleph1 has to say...

[antirename]

Read earlier post... they don't exactly define responsible disclosure, do they? A week? Two weeks? A month? A year? I think it was Fyodor who independantly came up with a framework for responsible disclosure. It will be interesting to see if Symantec is more interested in making potential problems public knowledge or protecting companies that could be embarrased by them.

It doesn't matter

[platypus]

If they believe they just need to shell out 75 million dollars for a stinking mailing list in order to contral an important part of the world's infrastructure, they are idiots.
Getting something to work like bugtraq technically is absolutely no problem. A mailing list with 30000 subscribers, ok let it be 300000, isn't voodoo.
The "selling point" of bugtraq is/was the trust many people have in them, the people which post there, their policy. If anything would cause people to mistrust them, it needs just one trusted guy from the security community to start a new list, and bugtraq is dead. I've even read a post that one alternative has already started.
If someone like Dan Farmer, Wietse Venema or, for the hell of it, Bruce Schneier decided to start a bugtraq clone, the original would not stand a chance if its reputation had already been damaged.

Aleph1; and, all good things come to an end.

[satch89450]

We believe that in order for the SecurityFocus/Bugtraq community to be effective, it must be an independent entity. We believe that its current disclosure policy is appropriate for the venue. Symantec will continue to operate with its separate disclosure policy.

Pretty words, Mr. Levy and Mr. Ahmad. Now where is the proof?

Those of us who are working journalists remember the transition of ABC News under Roone Arlege from Cronkite-esque "news" to "entertainment" -- and know that "independence" is a very fragile concept, one that can be crushed very quickly and with little fanfare at any level including the board room. All it takes is one vote of no-confidence on the part of the management to completely change the editorial head, and thus the independence of SecurityFocus. You most likely mean well -- can the same be said of your bosses? Can you point to one Symantec acquition that proved that editorial independence has been achieved in the long run?

I was an expert witness at a multi-million dollar trial because a well-respected computer magazine's editorial staff prostituted themselves to shore up a bad space-sales management decision. It only takes one episode to sully the good name of a publication. (The name of the publication is withheld from public statement to protect the guilty and to keep me out of civil court for defamation.)

I'm happy you were able to get a pile of money, but don't think that SecurityFocus will be viewed the same way. Now, if you had made the sale to an outfit like O'Reilly, the SecurityFocus name would have retained its luster and elan in the industry.

All good things must come to an end. Thanks for all the fish.

Re:Where is Symantec headed?

[Penguinshit]

As any security person (be he/she Guru or Technician) can tell you having a one-stop-shop app is A Bad Thing. Almost all of the security systems I've implemented in the past 8 years have been open-source (where I can see what's up) or have been a collection of simple apps where I can directly test the effectiveness and determine for myself whether it meets my requirements. Havine a monolithic black box for security just DOES NOT make me feel all warm and fuzzy. There is no amount of Saki which will do so in this case. Unfortunately, the world is becoming so overly point-and-click. It's too easy to sell an IT manager a singular panacea now. Caveat emptor, you say? But what if that makes it easier for some asshole to create multiple launch points for attacks? Being a good Netizen means making your system secure if for nothing else than to prevent it being perverted for use for attacking another's systems.

Re:What Aleph1 has to say...

[evilviper]

We do not provide detailed exploit code or provide samples of malicious code except to other trusted security researchers and in a secured manner.

No one else has commented that this is a bad thing... Am I the only one that thinks so?

Personally, I like nothing better than to get code which demonstrates and exploit, and see if the architecture I have put in place is designed well enough to stop attackers, or at least properly minimize the risk to my servers.

What good will this do anyhow? Do they think script kiddies will not get the exploit code now? Or is this calculated to give Symantec, and those who will partner with them (no doubt, in exchange for a hefty chunk of change) a distinct advantage over the general public?

Thank you for protecting me, and all sys-admins out there, from ourselves. How stupid we were to think we could secure and test the security of our systems without Symantec's approval!

Re:Conflict of Interest? - Valid conerns, but...

[Bravo_Two_Zero]

I think that's an absolutely valid concern, particularly given the propensity for the virus-killer companies (as they see themselves, anyway) to overblow virus threats.

But, I would say two things in their defense:

1) They tend to hype more than hide. The worst thing is that they will try to get securityfocus.com on the map with IT execs by hyping the security flaws disclosed in bugtraq. Now, it's a double-edge sword, but I don't think it will be awful if certain M$-based operating systems were a bit more publicly scrutinized.

2) Slashdot didn't change after the aquisition, at least not outwardly. I don't work here, so I can't talk about the behind-the-scenes, but the postings are as hard-hitting as ever. Granted, Andover isn't a corporation the size or with the intrests of Symantec. But it's a valid point.