full-disclosure - Gates: 'You don't need perfect code' for good security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Gates: 'You don't need perfect code' for good
 security

For all his usual intelligence, Valdis.Kletnieks@...edu oddly felt the 
need to ad:

> And for bonus points, explain how you fix the scheme so the poor sysadmin who
> has to run stuff at startup is able to find the folder, but an exploit running
> with 'administrator' or 'system' can't find it?

Re-read what I wrote.

I explained all that.

Like all security efforts, it is not a "perfect" solution.

It also does not work against all methods of exploitation or in all 
cases of exploitation using any given method.

However, it would have saved you from a bunch of once common IE 
exploits and will still save you from a huge amount of "work" done by 
thousands of next-to-clueless skiddies who take overly simple PoC 
exploits and are limited to altering them to simply gluing in the 
delivery of their preferred RAT/bot-net agent/etc.

As I already explained all that _and_ answered your question before you 
asked it, I gladly accept your bonus points...

Regards,

Nick FitzGerald