full-disclosure - Mozilla Firefox "Host:" Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat Sep 10 18:31:17 2005
From: larry at larryseltzer.com (Larry Seltzer)
Subject: Mozilla Firefox "Host:" Buffer Overflow

>>And how exactly do you propose to "leave out the details and PoC" when the
presence of the bug and the steps taken to fix it can not be concelaed from
public view given that the source code and the entire CVS entries are freely
available for anyone to browse?

You really don't think it woudl slow them down?

>>The proposal for obscurity serves well closed-source innitiatives and
development processes that have limited or no public visibility but it fails
in the presence of OSS. The "responsible disclosure" advocates act as if
Linux,*BSD,Mozilla and a zillion other open source projects did not exist in
reality.

The Mozilla team obviously disagrees with you, since they do try to hide
unresolved security problems, at least until (as in this case) the beans get
spilled in some other way.