full-disclosure - Security Alert: Unofficial IE patches appear oninternet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed Mar 29 00:53:17 2006
From: william at lefkovics.net (William Lefkovics)
Subject: Security Alert: Unofficial IE patches appear
	oninternet

Let me get this straight... on a list called Full Disclosure, you are in
fact recommending and endorsing the opposite?

________________________________

From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of n3td3v
Sent: Tuesday, March 28, 2006 1:30 PM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Security Alert: Unofficial IE patches appear
oninternet

On 3/28/06, bart.lansing@...hmail.com <bart.lansing@...hmail.com > wrote: 

	-----BEGIN PGP SIGNED MESSAGE-----
	Hash: SHA1

	Opinion on actual topic forthcoming:

	As someone not hiding behind a pseudo-leet handle, who actually 
	does get to deal with ramifications of Microsoft's (and others, of
	course) patch policies,  I heartily endorse the release of the eEye
	patch as beneficial and as a patch that will be in the hands of
	large numbers of users outside the infosec community in short 
	order.  In fact, it already is.  The Washington Post,
	ComputerWorld, ZDNet, Business Wire, The Register, and a host of
	others are all publicing its existence...kudos to them.

I would laugh if this wasn't such a serious issue, but even if its mentioned
on those sites, thats still not effective enough to give a safe alternative
to a Micrsoft patch, which is delivered almost automatically since service
pack two. 

To say your average single mom or eldery couple can be relied on to visit
those sites you've mentioned, (much of them U-S based), is frankly a
complete joke for a world-wide bug effecting world wide end user systems. 

Single moms, eldery couples, visit your nearest U-S based news outlet for
patches! Oh, I can see the mess which is about to unfold as soon as you
confuse the consumer about that, and before you do that, should you give the
consumer a list of "safe U-S media news sites". You can bet the phishers are
going to setup web pages, and perhaps even claiming via e-mail that Zdnet or
whatever is telling them about a third party patch "click here to download"
or "click here to visit the eeye website". Great stuff, you must admit. No
seriously.