Full Disclosure (mailing list)

Full Disclosure was a public, vendor-neutral mailing list for security vulnerability and exploit disclosure, founded on 9 July 2002 by Len Rose, who created and initially administered it, together with John Cartwright, who became its long-serving moderator. The list emerged as Symantec was in the process of acquiring SecurityFocus (the deal completed 6 August 2002), the company that owned Bugtraq, then the dominant vulnerability-disclosure list. Many researchers felt Bugtraq had “changed for the worse” under corporate ownership: moderation slowed — posts reportedly were no longer approved on weekends — and Symantec was accused of feeding delayed Bugtraq submissions into its commercial DeepSight threat-intelligence product ahead of public release. Full Disclosure was created to give researchers a faster, less encumbered outlet.

Policy and Character

Full Disclosure described itself as a forum for “detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events,” and operated under light moderation rather than full openness — administrators filtered spam and blatant abuse but otherwise let advisories, proof-of-concept code, and full exploits through with minimal gatekeeping. Its own archive description noted the list's “relaxed atmosphere” provided “comic relief and certain industry gossip” alongside serious research, and that “fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.”

Role in the Full-Disclosure Movement

Full Disclosure became one of the most prominent venues for the “full disclosure” school of vulnerability handling: publishing exploit details openly, at times without vendor coordination, on the premise that public pressure forced faster patching than private, vendor-controlled disclosure. Over nearly twelve years and, by one account, more than 91,500 posts, it carried zero-day releases and advisories touching Windows, Oracle, Apache, and countless smaller products, and it became known — and to some vendors, notorious — for hosting material that companies would have preferred kept confidential.

Shutdown and Successor

On 19 March 2014, in a message titled “Administrivia: The End,” John Cartwright announced he was suspending the list indefinitely. He wrote that the list had weathered “legal troubles along the way,” including “requests to delete things, requests not to delete things, and a variety of legal threats,” but that the immediate trigger was a request from an unnamed security researcher for large-scale deletion of archive material, which he compared to “taking a virtual hatchet to the list archives on the whim of an individual.” He added that “it's getting harder to operate an open forum in today's legal climate, let alone a security-related one.”

Six days later, on 25 March 2014, Fyodor (Gordon Lyon, creator of Nmap and operator of the seclists.org archive) relaunched the list in a post titled “Administrivia: A Fresh Start,” describing it as “a successor list in spirit” but “a fresh start” requiring subscribers to rejoin, hosted via nmap.org with archives at seclists.org/fulldisclosure/, moderated by volunteers from the community. That successor list has continued to operate since, distinct in administration from Cartwright's original grok.org.uk-hosted list.

Timeline

• 2002-07-09Full Disclosure mailing list founded by Len Rose and John Cartwright, hosted on netsys.com, as an alternative to Bugtraq.
• 2002-08-06Symantec completes its acquisition of SecurityFocus, the company operating Bugtraq -- the change in Bugtraq ownership and moderation that motivated Full Disclosure's creation.
• 2014-03-19John Cartwright posts "Administrivia: The End," announcing he is suspending the Full Disclosure list indefinitely, citing legal pressure and a deletion request from an unnamed researcher.
• 2014-03-25Fyodor (Gordon Lyon) posts "Administrivia: A Fresh Start," relaunching Full Disclosure as a community-moderated successor list hosted via nmap.org/seclists.org.