#0 - Vendors do not need to be ahed of the threat they only need to be ahead of the buyer

#1 - AV certifications do not test/require trojans

#2 - There is no perimeter

#3 - Risk management threatens vendors

#4 - There is more to risk than weak software

#5 - Compliance threatens security

#6 - Vendor blind spots allowed storm

#7 - Security has grown well past “Do it yourself”

my bad. 

Haha, yeah, that's one of the first things I thought of when I was looking at the HoH site... "this may be a good resource to watch over depending on who it attracts and who shares information..."

...the discovery of a server containing more than 1.4 gigabytes of stolen business and personal info brings home the real extent of the problem.

Data on the so-called crimeware server compromised 5,388 unique log files containing both email communications and web-related data. Net security firm Finjan reports that information on the server included business and customer data from 40 top-tier global businesses, including healthcare providers. It reckons the data was amassed in less than a month.

 
Hackers in the House
 
New social network for hackers lets white hats share and job-hunt
 
 
MAY 5, 2008 | 5:15 PM

By Kelly Jackson Higgins
Senior Editor, Dark Reading

First it was MySpace for the teens, then Facebook for the college set, and then LinkedIn for the business professionals -- and now there’s a social network just for hackers.

The House of Hackers social network was created and launched by researchers from GNUCitizen. "The House of Hackers community is established to support the hacker culture, mindset, way of life, ideologies, political views, vision, etc.," wrote researcher Petko Petkov on the GNUCitizen blog today.

Petkov said in the blog that House of Hackers members will be able to exchange ideas, create groups, tiger teams, and “elite circles,” collaborate on projects, and also “participate in the independent, recruitment market.”

...HD Moore, director of security research for BreakingPoint Systems, says his initial take on the House of Hackers announcement in the blog post is that the recruitment aspect of the House of Hackers could lure the wrong crowd. “If anything, hackers who work in security do all they can to appear professional and trustworthy and that really seems to undermine it,” Moore says. It could end up attracting "'employers'" who aren't interested in the legality of the work they sponsor, he says.