full-disclosure - Announcement: New Security Vulnerability List

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: booger at unixclan.net (security snot)
Subject: Announcement: New Security Vulnerability List

Ron,

I fully understand that you're no longer a scriptkiddie defacing with
gForce Pakistan, since you now operate your own security company; thus I
will treat you with the respect that you deserve and will attemt to engage
you in dialogue that is not condescending in nature.

While a particular vulnerability may allow "remote access exploitation",
as you say, the actual severity of the problem is normally determined by
the conditions required for "remote access exploitation" of the problem,
and how widespread it is.  Like many of your contributions to computer
security, including XSS, SQL injection, and various php-related problems
in scripts no one uses, I fully agree that these should be ranked as
"desparate" and not "medium" in severity.

Thank you for your time, and keep in mind that I would gladly meet with
you for coffee and chocolates at any time, to discuss our professional
differences.

-----------------------------------------------------------
"Whitehat by day, booger at night - I'm the security snot."
- CISSP / CCNA / A+ Certified - www.unixclan.net/~booger/ -
-----------------------------------------------------------

On Tue, 15 Jul 2003, Ron DuFresne wrote:

>
> They tend to lowball some of the severity of the issues they post though.
> Remote access exploitation should perhaps get more then moderate rating in
> the criticallity of an issue.
>
> Thanks,
>
> Ron DuFresne
>
> On Mon, 14 Jul 2003 potus@...hmail.com wrote:
>
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Sounds like a fine idea, but there is another one like it, I've been
> > on it for a month now:
> > http://secunia.com/secunia_security_advisories/
> >
> > I find it better, no html crap, well it doesn't seem to be 24/7, but
> > they do cut the bull.
> >
> > For real time tracking, nothing beats Full-Disclosure or VulnWatch, I
> > feel well covered with those three.
> >
> > Cya,
> >
> > PotUS
> > -----BEGIN PGP SIGNATURE-----
> > Note: This signature can be verified at https://www.hushtools.com/verify
> > Version: Hush 2.3
> >
> > wkYEARECAAYFAj8TKb0ACgkQ1uSyAYZWjziShACfcgW+Ls5OgcNiiLvf9vXIhG5fli8A
> > oLZx0vOGQXbE7gz9S5a0t7BXRyJl
> > =+5K0
> > -----END PGP SIGNATURE-----
> >
> >
> >
> >
> > Concerned about your privacy? Follow this link to get
> > FREE encrypted email: https://www.hushmail.com/?l=2
> >
> > Free, ultra-private instant messaging with Hush Messenger
> > https://www.hushmail.com/services.php?subloc=messenger&l=434
> >
> > Promote security and make money with the Hushmail Affiliate Program:
> > https://www.hushmail.com/about.php?subloc=affiliate&l=427
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> "Cutting the space budget really restores my faith in humanity.  It
> eliminates dreams, goals, and ideals and lets us get straight to the
> business of hate, debauchery, and self-annihilation." -- Johnny Hart
> 	***testing, only testing, and damn good at it too!***
>
> OK, so you're a Ph.D.  Just don't touch anything.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>