Apparently their "solution" was to get an NDA and not actually fix the
software issue.
As a software developer highly familiar and concerned
with security:
I certainly can't, in good conscience, recommend software
from a company who appears to believe Legal means via threats of wrongful
imprisonment and forced signing of an NDA is the appropriate solution rather
then fixing the software issue.
RAS[ Reply to This | Parent | # ]
|
Another
Link
After Al-Khabaz informed the school of the issue, the
Director of Information Services and Technology François Paradis told him that
the school and the makers of Omnivox, the ominously named Skytech would
immediately fix the problem. After two days Al-Khabaz used Acunetix, a program
designed to find security vulnerabilities in software, to see if the problem was
really fixed.
That’s when the president of Skytech called, accused Al-Khabaz
of a cyber-attack, and threatened him with prosecution and jail time if he
didn’t sign a non-disclosure agreement, which he did. The president of Skytech,
Edouard Taza, denies making threats, but did admit to mentioning the police and
the legal consequences. That sounds pretty threatening.
There
is something funny going on. First, Acunetix is not
Skytech software. Skytech
already knew of the hole, days
before, so why was there no NDA back then? As to
the running
of the scan, what possibly could have been learned that
would
require a NDA at that point that was not already known days earlier? Why would
Skytech want the NDA instead
of the school system? It almost seems as though
Skytech
believes they own the data! Maybe the system was built
with intentional
holes.
Possibly the Skytech president looked at the personal data
in order
to make the phone call too.
The management of this kind of data should
never be farmed out to a third party. It should be managed via an
in-house
system.
---
You are being MICROattacked, from various angles, in a SOFT manner. [ Reply to This | Parent | # ]
|