| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu Jun 30 21:05:35 2005 From: kf_lists at digitalmunition.com (KF (lists)) Subject: Publishing exploit code - what is it good for Change control policy at one of my jobs put me in an identical situation. I flat out could not patch a machine unless I could produce a cmd.exe or /bin/sh prompt remotely. Putting that stuff aside how about the vendors that like to try to hide things from you? Vendors love Jedi Mind tricks..."these aren't the droids you are looking for." If PoC is not produced you are never hip to the things that leave your OS vulnerable. For example... http://news.com.com/2100-1023-947325.html -KF Kenneth Ng wrote: >I have had administrators refuse to patch systems until I could prove >that I could break in using an exploit right in front of them. I've >been told that they need to balance my theoritical risk against their >actual outlay of resources (yet, for some reason, they bet the >lottery). > >On 6/30/05, Jason Coombs <jasonc@...ence.org> wrote: > > >>>What I need is a security administrator, CSO, IT manager or sys admin >>>that can explain why they find public exploits are good for THEIR >>>organizations. Maybe we can start changing public opinion with regards >>>to full disclosure, and hopefully start with this opinion leader. >>> >>> >_______________________________________________ >Full-Disclosure - We believe in it. >Charter: http://lists.grok.org.uk/full-disclosure-charter.html >Hosted and sponsored by Secunia - http://secunia.com/ > > > > >
Powered by blists - more mailing lists